Close Open Privacy Scan

link https://github.com/microsoft/semantic-kernel

bolt Snapshot: commit c781da1

science engine v1.21

schedule 2026-07-18T00:17:09.414049+00:00

smart_toy MCP server detected: anthropic, chromadb, mcp, mistralai +4 more — detected in dependencies, not a safety judgment.

App Privacy Score

0 /100

High privacy risk — possible application leak

High risk · 4715 finding(s)

Dependency score: 0 (High risk)

bar_chart Score Breakdown

pii_flow −60

telemetry −25

egress −15

env_fs −3

list Scan Summary

0 high 736 medium 3979 low

First-party packages: 2

Dependency packages: 48

Ecosystem: python

swap_horiz Potential data exfiltration in application code

External domains: 0001:002:003:0004::11.2.3.4::ffff:192.168.0.1a-za-z0-9._-a2a-protocol.orgacasessions.ioaclanthology.orgacme.comagentskills.ioaggregate.ee.engr.uky.eduai.azure.comai.google.devaiohttp.readthedocs.ioaiplatform.eu.rep.googleapis.comaiplatform.googleapis.comaiplatform.us.rep.googleapis.comaka.msapi-dashboard.search.brave.comapi-inference.huggingface.coapi.anthropic.comapi.bing.microsoft.comapi.cloudflare.comapi.deepseek.comapi.eu.mistral.aiapi.github.comapi.jina.aiapi.langcache.comapi.mistral.aiapi.morphllm.comapi.nuget.orgapi.openai.comapi.pinecone.ioapi.powerplatform.comapi.search.brave.comapi.slack.comapi.together.xyzapi.us.mistral.aiapnews.comapp.neptune.aiarrow.apache.orgarticles-en-preview-xyz.pinecone.ioarticles-en-preview.svc.pinecone.ioarxiv.orgauai.orgauth.openai.comaws-us-east-1.langcache.redis.ioaws.amazon.combitbucket.orgblog.research.googleboto3.amazonaws.combrotlipy.readthedocs.iobugreports.qt.iobugs.python.orgbugs.winehq.orgbugzilla.gnome.orgcdn-media.huggingface.cocdn.britannica.comcdn.jsdelivr.netcdn.mathjax.orgcens.ioc.eechroma-onnx-models.s3.amazonaws.comchromiumdash.appspot.comclaude.googleapis.comclear.mlclick.palletsprojects.comclip-cn-beijing.oss-cn-beijing.aliyuncs.comcloud.google.comcognitiveservices.azure.comcohere.aicollaboration.cmc.ec.gc.caconsole.anthropic.comconsole.cloud.google.comconsole.developers.google.comconsole.mistral.aiconsole.nvidia.comconsole.pinecone.ioconverter.swagger.iocookbook.openai.comcosmos.azure.comcran.r-project.orgcrates.iocvs.pgfoundry.orgdagshub.comdash.voyageai.comdashboard.cohere.comdata-apis.orgdata.iana.orgdatabase.windows.netdatatracker.ietf.orgdbinference.azure.comdeveloper.mozilla.orgdevelopers.cloudflare.comdevelopers.google.comdevguide.python.orgdigitalassets.lib.berkeley.edudiscord.ggdiscuss.huggingface.codiscuss.python.orgdiscuss.pytorch.orgdl.acm.orgdmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdochub.mongodb.orgdocs.ag2.aidocs.aiohttp.orgdocs.anthropic.comdocs.api.nvidia.comdocs.atlas.mongodb.comdocs.aws.amazon.comdocs.bodo.aidocs.cloud.google.comdocs.cohere.comdocs.docker.comdocs.litellm.aidocs.llamaindex.aidocs.mistral.aidocs.neptune.aidocs.nomic.aidocs.nvidia.comdocs.oracle.comdocs.parallel.aidocs.pinecone.iodocs.pydantic.devdocs.pytest.orgdocs.python-requests.orgdocs.python.orgdocs.pytorch.orgdocs.ray.iodocs.rsdocs.scipy.orgdocs.sqlalchemy.orgdocs.swanlab.cndocs.sympy.orgdocs.together.aidocs.trychroma.comdocs.voyageai.comdocs.wandb.aidocs.weaviate.iodocs.zilliz.comdoi.orgdownload.tsi.telecom-paristech.frdrive.google.comdvc.orgeli.thegreenplace.netembed.trychroma.comen.wikipedia.orgen.wikiversity.orgerrors.pydantic.devessentia.upf.eduexam_ple.comexample-resource.azure.openai.comexample-resource.services.ai.azure.comexslt.orgfarm4.staticflickr.comfilesystem-spec.readthedocs.ioflyte.orgfonts.googleapis.comfoo.comgateway.ai.cloudflare.comgcc.gnu.orggenerativelanguage.googleapis.comgiou.stanford.edugist.github.comgithub.comgitlab.freedesktop.orggitmcp.iogitter.imgoo.glgoogle-auth.readthedocs.iogoogle.aip.devgoogle.github.iographics.stanford.edugroups.google.comgrpc.github.ioguillaumejaume.github.iohelp.openai.comhf.cohg.python.orghips.hearstapps.comhost.docker.internalhtml.spec.whatwg.orghttpbin.orghub-ci.huggingface.cohuggingface.cohypothesis.readthedocs.ioi.postimg.ccicml.ccimageio.readthedocs.ioimages.cocodataset.orgimages.pexels.cominfer.roboflow.cominference.do-ai.runintegrate.api.nvidia.comipython.orgipython.readthedocs.ioj3-fortran.orgjson-schema.orgjsonlines.orgkexue.fmkubernetes.iolearn.microsoft.comlibsdl.orglinux.die.netlogin.microsoft.comlogin.microsoftonline.comlogin.pinecone.iolucene.apache.orgmanagement.azure.commanagement.core.chinacloudapi.cnmanagement.core.usgovcloudapi.netmanagement.core.windows.netmarc.najork.orgmathworld.wolfram.commatplotlib.orgmesonbuild.commetacpan.orgmicrosoft.github.iomilvus.iomistralai.github.ioml.azure.commodel-spec.openai.commodelcontextprotocol.iomongodb.commsdn.microsoft.commy-index.svc.pinecone.iomy-keyvault-name.vault.azure.netmy-sharepoint-site.commypy.readthedocs.iomüller.denats.ionexusraven.nexusflow.ainicolas.limare.netnineplanets.orgnlp.stanford.edunodatime.orgnumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnumpydoc.readthedocs.ionvidia.coollama.comomoindrot.github.ioonnxruntime.aiopenai.comopenapi-core.readthedocs.ioopenapis.orgopenreview.netopentelemetry.iooptuna.readthedocs.iooss.redis.comother.compackages.msys2.orgpackaging.python.orgpaddle-model-ecology.bj.bcebos.compandas.pydata.orgparquet.apache.orgpbs.twimg.compenghao-bdsc.github.iopeople.eecs.berkeley.edupeps.python.orgpersonal.math.ubc.capiblpmmdsiknacjnm1ltla.c1.europe-west3.gcp.weaviate.cloudpkg.go.devplatform.claude.complatform.openai.comportal.azure.compresbrey.mit.eduproceedings.neurips.ccprod-1-data.ke.pinecone.ioproto-plus-python.readthedocs.ioprotobuf.devpublic.ukp.informatik.tu-darmstadt.depydantic-docs.helpmanual.iopyinstaller.readthedocs.iopymongo.readthedocs.iopyperclip.readthedocs.iopypi.orgpypi.python.orgpypika.readthedocs.iopython-devtools.helpmanual.iopython-oracledb.readthedocs.iopython.orgpytorch.orgqianwen-res.oss-cn-beijing.aliyuncs.comqwenlm.github.ioraw.githubusercontent.comreact.devreactjs.orgredis-py.readthedocs.ioredis.comredis.ioredis.readthedocs.ioredisearch.iorequests.readthedocs.iorich.readthedocs.iorrc.cvc.uab.essafetensors-convert.hf.spacesbert.netschema.orgschemas.microsoft.comscikit-image.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgscrapethis.comsearch.azure.comsome-cohere-baseurl.aisome-url.comsourceforge.netsourceware.orgspdx.orgspeakeasy.comspec.openapis.orgspecs.frictionlessdata.iosports.yahoo.comstackoverflow.comstorage.googleapis.comsuno-ai.notion.sitesupport.atlassian.comsupport.sas.comswagger.ioswanlab.cntartarus.orgtelemetry.googleapis.comtelemetry.mtls.googleapis.comthumbs.dreamstime.comtimeapi.iotinyurl.comtools.ietf.orgtornadoweb.orgtowardsdatascience.comtruststore.readthedocs.iotwitter.comtyping-extensions.readthedocs.iotyping.python.orgupload.wikimedia.orgus-central1-kfp.pkg.devus-kfp.pkg.devviews.scientific-python.orgw3c.github.ioweaviate.ioweb.archive.orgwebsockets.readthedocs.iowerkzeug.palletsprojects.comwiki.centos.orgwixtoolset.orgwrapdb.mesonbuild.comwttr.inwww.aclweb.orgwww.ams.orgwww.bing.comwww.britannica.comwww.comet.comwww.cs.cmu.eduwww.deepmind.comwww.dvc.orgwww.ecma-international.orgwww.example.珠宝www.gevent.orgwww.github.comwww.google.comwww.googleapis.comwww.iana.orgwww.ietf.orgwww.ilankelman.orgwww.intel.comwww.kxan.comwww.math.hmc.eduwww.mathjax.orgwww.mathworks.comwww.microsoft.comwww.mlflow.orgwww.mongodb.comwww.nature.comwww.ncaa.comwww.nfl.comwww.oasis-open.orgwww.openblas.netwww.opm.govwww.oracle.comwww.paddleocr.aiwww.pcre.orgwww.postgresql.orgwww.python-httpx.orgwww.python.orgwww.researchgate.netwww.reuters.comwww.rfc-editor.orgwww.sbert.netwww.scipy.orgwww.stata.comwww.statsmodels.orgwww.stixfonts.orgwww.tensorflow.orgwww.tornadoweb.orgwww.tvtechnology.comwww.w3.orgwww.w3schools.comwww.wandb.comwww.weaviate.iowww.webrtc.orgwww.wikipedia.orgwww.xudongz.comwww.xyz.eduxarray.pydata.orgxlrd.readthedocs.ioxn--fiqs8s.icom.museumyour-endpoint.cognitiveservices.azure.comyour-resource-name.openai.azure.comyour-unique-host.openai.azure.com

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:49 → repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:91

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:30 → repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:59

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/agent_with_mcp_plugin.py:40 → repo/python/samples/concepts/mcp/agent_with_mcp_plugin.py:58

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:56 → repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:97

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:56 → repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:99

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/azure_ai_agent_with_mcp_plugin.py:33 → repo/python/samples/concepts/mcp/azure_ai_agent_with_mcp_plugin.py:60

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/local_agent_with_local_server.py:52 → repo/python/samples/concepts/mcp/local_agent_with_local_server.py:86

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/local_agent_with_local_server.py:52 → repo/python/samples/concepts/mcp/local_agent_with_local_server.py:101

medium first-party (python): python PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/local_agent_with_local_server.py:52 → repo/python/samples/concepts/mcp/local_agent_with_local_server.py:103

medium first-party (python): python A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

repo/python/samples/learn_resources/plugins/GithubPlugin/github.py:102 → repo/python/samples/learn_resources/plugins/GithubPlugin/github.py:105

hub Dependency data flows (111)

medium mcp dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:433 → pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:452

medium transformers dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 → pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514

medium azure-identity dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:66 → pkgs/python/[email protected]/azure/identity/_credentials/environment.py:99

medium azure-identity dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:60 → pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:77

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:70

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:127

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:73

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:134

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication.py:32 → pkgs/python/[email protected]/samples/sample_authentication.py:39

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication.py:48 → pkgs/python/[email protected]/samples/sample_authentication.py:55

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication_async.py:33 → pkgs/python/[email protected]/samples/sample_authentication_async.py:41

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication_async.py:50 → pkgs/python/[email protected]/samples/sample_authentication_async.py:58

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:59

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:72

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:87

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:100

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → pkgs/python/[email protected]/samples/sample_documents_crud.py:115

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:61

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:77

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:93

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:107

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_documents_crud_async.py:123

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → pkgs/python/[email protected]/samples/sample_index_alias_crud.py:42

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → pkgs/python/[email protected]/samples/sample_index_alias_crud.py:54

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → pkgs/python/[email protected]/samples/sample_index_alias_crud.py:108

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:44

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:57

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:112

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_analyze_text.py:26 → pkgs/python/[email protected]/samples/sample_index_analyze_text.py:43

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:27 → pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:45

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:33 → pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:46

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:37 → pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:51

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:69

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:80

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:126

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:26 → pkgs/python/[email protected]/samples/sample_index_crud.py:139

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_index_crud_async.py:72

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_index_crud_async.py:84

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → pkgs/python/[email protected]/samples/sample_index_crud_async.py:132

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:43

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:59

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:71

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:85

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:45

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:62

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:75

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:90

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:74

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:87

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:99

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_crud.py:112

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:80

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:94

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:107

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:121

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:51

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:64

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:76

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:52

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:66

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:79

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → pkgs/python/[email protected]/samples/sample_indexer_workflow.py:119

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → pkgs/python/[email protected]/samples/sample_indexer_workflow.py:130

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → pkgs/python/[email protected]/samples/sample_indexer_workflow.py:134

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_autocomplete.py:26 → pkgs/python/[email protected]/samples/sample_query_autocomplete.py:40

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:28 → pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:43

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_facets.py:26 → pkgs/python/[email protected]/samples/sample_query_facets.py:43

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_facets_async.py:28 → pkgs/python/[email protected]/samples/sample_query_facets_async.py:46

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_filter.py:26 → pkgs/python/[email protected]/samples/sample_query_filter.py:45

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_filter_async.py:28 → pkgs/python/[email protected]/samples/sample_query_filter_async.py:48

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:66

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:67

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:89

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → pkgs/python/[email protected]/samples/sample_query_semantic.py:90

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:69

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:70

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:91

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → pkgs/python/[email protected]/samples/sample_query_semantic_async.py:92

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_session.py:24 → pkgs/python/[email protected]/samples/sample_query_session.py:38

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_session_async.py:25 → pkgs/python/[email protected]/samples/sample_query_session_async.py:40

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_simple.py:24 → pkgs/python/[email protected]/samples/sample_query_simple.py:38

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_simple_async.py:26 → pkgs/python/[email protected]/samples/sample_query_simple_async.py:41

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_suggestions.py:24 → pkgs/python/[email protected]/samples/sample_query_suggestions.py:39

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:26 → pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:42

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:130

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:148

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:170

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:196

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:221

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:222

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:223

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:224

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:225

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:50 → pkgs/python/[email protected]/samples/sample_query_vector.py:226

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:134

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:153

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:176

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:204

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:230

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:231

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:232

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:233

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:234

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → pkgs/python/[email protected]/samples/sample_query_vector_async.py:235

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:25 → pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:42

medium azure-search-documents dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:26 → pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:48

medium google-cloud-aiplatform dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:1851 → pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:1848

pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1803 → pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1800

pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1845 → pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1842

pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1960 → pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1957

pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1794 → pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1791

</> First-Party Code

first-party (python): python

python first-party

medium pii_flow production #cac6c4047a79bf2d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:91 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:49 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:91

                    print(f"# {response.role} - {response.name or '*'}: '{r}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #819ecfbb759eab6b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:93 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:49 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:93

                    print(
                        f"# {response.role} - {response.name or '*'}: Function Name: '{fn}', Arguments: '{arguments}'"  # noqa: E501
                    )

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #b2db2826338f1b35 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:97 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:49 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:97

                    print(f"# {response.role} - {response.name or '*'}: '{response}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #68784c6cfe83d674 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:59 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:30 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:59

        print(f"# {response.role} - {response.name or '*'}: '{response}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #0e73c002ead3dcea — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/agent_with_mcp_plugin.py:58 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/agent_with_mcp_plugin.py:40 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/agent_with_mcp_plugin.py:58

            print(f"# {response.name}: {response} ")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #d07aa7efcbc905db — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:97 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:56 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:97

                    print(f"# {response.name}: ", end="", flush=True)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #39d80528f16d435b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:99 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:56 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:99

                print(response.content, end="", flush=True)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #e82957471b306be3 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/azure_ai_agent_with_mcp_plugin.py:60 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/azure_ai_agent_with_mcp_plugin.py:33 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/azure_ai_agent_with_mcp_plugin.py:60

                print(f"# {response.name}: {response} ")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #02119b4ae91589c5 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/local_agent_with_local_server.py:86 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/local_agent_with_local_server.py:52 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/local_agent_with_local_server.py:86

        print(f"Agent uses Ollama with the {agent.service.ai_model_id} model")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #c9d5cae21ecc4f00 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/local_agent_with_local_server.py:101 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/local_agent_with_local_server.py:52 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/local_agent_with_local_server.py:101

                    print(f"# {response.name}: ", end="", flush=True)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #9c3269ddf418c8e7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/python/samples/concepts/mcp/local_agent_with_local_server.py:103 · flow /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/local_agent_with_local_server.py:52 → /tmp/closeopen-isn73khu/repo/python/samples/concepts/mcp/local_agent_with_local_server.py:103

                print(response.content, end="", flush=True)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium telemetry test-only Excluded from app score #a4532c1b81e90465 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/custom_selection_strategy.py:5

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #f55b26e602863b85 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/custom_termination_strategy.py:5

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #32998da2995c647d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:8

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #0c9fb98b1d7e314f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:9

from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #7eef0cc216d48fb9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:10

from opentelemetry.semconv.resource import ResourceAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #7f4a18cc4c7d7807 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:62

    from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #54533ce0eb7e97fd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:63

    from opentelemetry.sdk.trace.export import BatchSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #f906fa252468c093 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:64

    from opentelemetry.trace import set_tracer_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #e6fee812a5692d6a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:77

    from opentelemetry._logs import set_logger_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #1840389fabeea37f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:78

    from opentelemetry.sdk._logs import LoggerProvider, LoggingHandler

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #279c8859aa008f90 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/document_generator/main.py:79

    from opentelemetry.sdk._logs.export import BatchLogRecordProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #ce47c657f8cf3a92 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:13

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #3bcd458092393e7f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:14

from opentelemetry._logs import set_logger_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #dd1e0afb0c63354c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:15

from opentelemetry.exporter.otlp.proto.grpc._log_exporter import OTLPLogExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #193ec5d78b79d001 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:16

from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import OTLPMetricExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #ba7d06bf31e4d666 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:17

from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #53a0397e3ffa09f8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:18

from opentelemetry.metrics import set_meter_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #9c84e01c855035d6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:19

from opentelemetry.sdk._logs import LoggerProvider, LoggingHandler

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #fe0f51b55e906bcf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:20

from opentelemetry.sdk._logs.export import BatchLogRecordProcessor, ConsoleLogExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #cc2734143fcb6c93 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:21

from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #134169895aa80bd8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:22

from opentelemetry.sdk.metrics.export import ConsoleMetricExporter, PeriodicExportingMetricReader

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #b226c28506246dd7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:23

from opentelemetry.sdk.metrics.view import DropAggregation, View

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #fca8dfb518cab763 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:24

from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #268dab22eb402993 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:25

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #da5813267b58b882 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:26

from opentelemetry.sdk.trace.export import BatchSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #043b6fb45ca5c57a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:27

from opentelemetry.semconv.resource import ResourceAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #c3fc365d81bb4f45 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:28

from opentelemetry.trace import set_tracer_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #f873539884316333 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/main.py:29

from opentelemetry.trace.span import format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry test-only Excluded from app score #54b04f5ce54a2cd4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/demos/telemetry/scenarios.py:3

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #6c5720a48ec2f0ce — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:8

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #b187c16c2a0593e4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:9

from opentelemetry._logs import set_logger_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #09c269d87f49c95d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:10

from opentelemetry.sdk._logs import LoggerProvider, LoggingHandler

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #5f70b3c55a98d929 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:11

from opentelemetry.sdk._logs.export import BatchLogRecordProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #21485aa70d3f4936 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:12

from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #40ae1e73711f0a85 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:13

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #db4a80657aa94934 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:14

from opentelemetry.sdk.trace.export import BatchSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #f6ce910218cbdfc1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:15

from opentelemetry.semconv.resource import ResourceAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #52a6556a7b5023e8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:16

from opentelemetry.trace import set_tracer_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #5018e02abc494b33 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:17

from opentelemetry.trace.span import format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #322b34604c11ac4e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/step4c_handoff_mix_agent_types.py:8

from opentelemetry.trace import NoOpTracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium pii_flow production #235a6e9133167afa — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

repo/python/samples/learn_resources/plugins/GithubPlugin/github.py:105 · flow /tmp/closeopen-isn73khu/repo/python/samples/learn_resources/plugins/GithubPlugin/github.py:102 → /tmp/closeopen-isn73khu/repo/python/samples/learn_resources/plugins/GithubPlugin/github.py:105

        return httpx.AsyncClient(base_url=self.settings.base_url, headers=headers, timeout=5)

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium telemetry production #956ff908cc1bb13a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/propagation.py:7

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #75924b2e8bac73e4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/propagation.py:8

from opentelemetry.propagate import extract

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #4d4ff3d2a75fdb02 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/propagation.py:9

from opentelemetry.trace import Link, get_current_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #b9b8d7d545d86b4f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/propagation.py:10

from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #0abd091d5262c164 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/tracing.py:7

from opentelemetry.trace import NoOpTracerProvider, Span, SpanKind, TracerProvider, get_tracer_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #f1d19895a11892eb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/tracing.py:8

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #b3acd1777a009082 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/tracing_config.py:7

from opentelemetry.trace import SpanKind

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #bdda0437ea1d917a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/core/telemetry/tracing_config.py:8

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #d39867c537301195 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/agents/runtime/in_process/in_process_runtime.py:21

from opentelemetry.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #553a68023dbab8e0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/connectors/ai/chat_completion_client_base.py:11

from opentelemetry.trace import Span, Tracer, get_tracer, use_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #7bd3597e9d4903f8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/functions/kernel_function.py:12

from opentelemetry import metrics, trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #dcaf57d046de5885 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/functions/kernel_function.py:13

from opentelemetry.semconv.attributes.error_attributes import ERROR_TYPE

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #dde6bd91a1c91d6e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/utils/telemetry/agent_diagnostics/decorators.py:9

from opentelemetry.trace import Span, StatusCode, get_tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #af42a4b1876455e0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/utils/telemetry/model_diagnostics/decorators.py:10

from opentelemetry.trace import Span, StatusCode, get_tracer, use_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #8cf101109be9b7ae — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

repo/python/semantic_kernel/utils/telemetry/model_diagnostics/function_tracer.py:5

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 105 low-confidence finding(s)

low env_fs production #68b62704b9882279 — Environment-variable access.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_convo_with_tools.py:49

            "config_list": [{"model": os.environ["OPENAI_CHAT_MODEL_ID"], "api_key": os.environ["OPENAI_API_KEY"]}]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #31101614b3498139 — Environment-variable access.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:28

                    "model": os.environ["OPENAI_CHAT_MODEL_ID"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a64120dcb60d0492 — Environment-variable access.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:30

                    "api_key": os.environ.get("OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e620f27ccbc7205a — Environment-variable access.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:45

                    "model": os.environ["OPENAI_CHAT_MODEL_ID"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #50e7440edacc930b — Environment-variable access.

repo/python/samples/concepts/agents/autogen_conversable_agent/autogen_conversable_agent_simple_convo.py:47

                    "api_key": os.environ.get("OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #de555d685db210ab — Filesystem access.

repo/python/samples/concepts/agents/mixed_chat/mixed_chat_files.py:53

    with open(file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #787c7247494bd40e — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/azure_openai_assistant_declarative_code_interpreter.py:49

    with open(csv_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #dd912539113a11e0 — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/azure_openai_assistant_declarative_file_search.py:49

    with open(pdf_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a27783b17051364b — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/openai_assistant_declarative_code_interpreter.py:47

    with open(csv_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e5f0187a24ce8088 — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/openai_assistant_declarative_file_search.py:48

    with open(pdf_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fb8f4dc80d6e9146 — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/openai_assistant_file_manipulation.py:32

    with open(csv_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e9aeb790090f869d — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/openai_assistant_file_manipulation_streaming.py:31

    with open(csv_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #209064d999cd299f — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/openai_assistant_sample_utils.py:28

        with open(file_path, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7fbfb9d15b3ba6db — Filesystem access.

repo/python/samples/concepts/agents/openai_assistant/openai_assistant_vision_streaming.py:28

    with open(file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #26b62e0810eebe57 — Filesystem access.

repo/python/samples/concepts/agents/openai_responses/azure_openai_responses_agent_declarative_file_search.py:46

    with open(pdf_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #89eb9200bb068abc — Filesystem access.

repo/python/samples/concepts/agents/openai_responses/openai_responses_agent_declarative_file_search.py:45

    with open(pdf_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c68b89c0799820b7 — Filesystem access.

repo/python/samples/concepts/agents/openai_responses/responses_agent_file_search_streaming.py:38

    with open(pdf_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #328dde5d816c4b80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/concepts/images/image_gen_prompt.py:44

        img = Image.open(urlopen(str(result.value[0].uri)))  # nosec

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #483d5f7c22b44bc6 — Environment-variable access.

repo/python/samples/concepts/mcp/agent_with_mcp_agent.py:39

                "AZURE_OPENAI_CHAT_DEPLOYMENT_NAME": os.getenv("AZURE_OPENAI_CHAT_DEPLOYMENT_NAME"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #483655106db8be9b — Environment-variable access.

repo/python/samples/concepts/mcp/agent_with_mcp_agent.py:40

                "AZURE_OPENAI_ENDPOINT": os.getenv("AZURE_OPENAI_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #32540aea22b34d95 — Environment-variable access.

repo/python/samples/concepts/mcp/agent_with_mcp_agent.py:53

                "AZURE_OPENAI_CHAT_DEPLOYMENT_NAME": os.getenv("AZURE_OPENAI_CHAT_DEPLOYMENT_NAME"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #878f4da997f77457 — Environment-variable access.

repo/python/samples/concepts/mcp/agent_with_mcp_agent.py:54

                "AZURE_OPENAI_ENDPOINT": os.getenv("AZURE_OPENAI_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5512f6fd9c4c4c62 — Environment-variable access.

repo/python/samples/concepts/mcp/agent_with_mcp_plugin.py:40

        env={"GITHUB_PERSONAL_ACCESS_TOKEN": os.getenv("GITHUB_PERSONAL_ACCESS_TOKEN")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1f99f294dcd76fdb — Environment-variable access.

repo/python/samples/concepts/mcp/azure_ai_agent_with_local_server.py:56

            env={"GITHUB_PERSONAL_ACCESS_TOKEN": os.getenv("GITHUB_PERSONAL_ACCESS_TOKEN")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #74ac8585579e5389 — Environment-variable access.

repo/python/samples/concepts/mcp/azure_ai_agent_with_mcp_plugin.py:33

            env={"GITHUB_PERSONAL_ACCESS_TOKEN": os.getenv("GITHUB_PERSONAL_ACCESS_TOKEN")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0f96711e0612b544 — Environment-variable access.

repo/python/samples/concepts/mcp/local_agent_with_local_server.py:52

            env={"GITHUB_PERSONAL_ACCESS_TOKEN": os.getenv("GITHUB_PERSONAL_ACCESS_TOKEN")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cff19c2bd912e88a — Environment-variable access.

repo/python/samples/concepts/mcp/mcp_as_plugin.py:105

        env={"GITHUB_PERSONAL_ACCESS_TOKEN": os.getenv("GITHUB_PERSONAL_ACCESS_TOKEN")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #607fac74c48f3ec2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/concepts/memory/azure_ai_search_hotel_samples/data_model.py:91

    response = requests.get(url, timeout=60)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #c637b3eb11228291 — Environment-variable access.

repo/python/samples/concepts/setup/openai_env_setup.py:44

    api_key = os.getenv("MY_API_KEY_VAR_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress test-only Excluded from app score #bce6552985cfe3a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/demos/booking_restaurant/bookings_plugin/bookings_plugin.py:106

        response = await self.graph_client.solutions.booking_businesses.by_booking_business_id(
            self.booking_business_id
        ).appointments.post(request_body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs test-only Excluded from app score #653f65f6ca3719c8 — Environment-variable access.

repo/python/samples/demos/call_automation/call_automation.py:56

CALLBACK_URI_HOST = os.environ["CALLBACK_URI_HOST"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #904819829e328616 — Environment-variable access.

repo/python/samples/demos/call_automation/call_automation.py:59

acs_client = CallAutomationClient.from_connection_string(os.environ["ACS_CONNECTION_STRING"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #225374402da3085e — Environment-variable access.

repo/python/samples/demos/copilot_studio_agent/src/chat.py:22

    bot_secret=os.getenv("BOT_SECRET"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #08e9c8c85a6d1919 — Environment-variable access.

repo/python/samples/demos/copilot_studio_agent/src/chat.py:23

    bot_endpoint=os.getenv("BOT_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow test-only Excluded from app score #2a24f147a39ece59 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

repo/python/samples/demos/copilot_studio_agent/src/chat.py:42 · flow /tmp/closeopen-isn73khu/repo/python/samples/demos/copilot_studio_agent/src/chat.py:22 → /tmp/closeopen-isn73khu/repo/python/samples/demos/copilot_studio_agent/src/chat.py:42

    logger.info(f"Response: {response}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low egress test-only Excluded from app score #5497de3a455e45ce — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/demos/copilot_studio_agent/src/direct_line_agent.py:58

                async with self.session.post(url, headers=headers) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress test-only Excluded from app score #bcee5caea160615b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/demos/copilot_studio_agent/src/direct_line_agent.py:69

                async with self.session.get(self.token_endpoint) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress test-only Excluded from app score #d467d478d89c42f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/demos/copilot_studio_agent/src/direct_line_agent.py:185

            async with self.session.post(start_conv_url, headers=headers) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress test-only Excluded from app score #d7fe031151ffd1d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/demos/copilot_studio_agent/src/direct_line_agent.py:196

        async with self.session.post(activities_url, json=payload, headers=headers) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress test-only Excluded from app score #5b80d6f0c2ee2be7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/demos/copilot_studio_agent/src/direct_line_agent.py:208

            async with self.session.get(url, headers=headers) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs test-only Excluded from app score #67a92ecb08f4dd90 — Filesystem access.

repo/python/samples/demos/copilot_studio_skill/src/api/app.py:32

    with open("copilot-studio.manifest.json") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #c89760c23fd0d7a4 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/app.py:37

        fqdn = f"https://{os.getenv('CONTAINER_APP_NAME')}.{os.getenv('CONTAINER_APP_ENV_DNS_SUFFIX')}/api/messages"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #c163da88ad5ad74b — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:13

    HOST = os.getenv("HOST", "localhost")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a9d111f038660554 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:14

    PORT = int(os.getenv("PORT", 8080))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #872ff453ed57abfb — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:19

    APP_ID = os.getenv("BOT_APP_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #7f9e1c6607dd67db — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:20

    APP_PASSWORD = os.getenv("BOT_PASSWORD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6c81e88d0b234130 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:21

    APP_TENANTID = os.getenv("BOT_TENANT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #9ae04c1f3eca4ee8 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:22

    APP_TYPE = os.getenv("APP_TYPE", "singletenant")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #04184616ef46f687 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:27

    ALLOWED_CALLERS = os.getenv("ALLOWED_CALLERS", ["*"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a97c07a22aef9bc4 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:30

    AZURE_OPENAI_CHAT_DEPLOYMENT_NAME = os.getenv("AZURE_OPENAI_CHAT_DEPLOYMENT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #e7fe5d8cc329a907 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:31

    AZURE_OPENAI_ENDPOINT = os.getenv("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #b7659d6e436ef5f8 — Environment-variable access.

repo/python/samples/demos/copilot_studio_skill/src/api/config.py:32

    AZURE_OPENAI_API_VERSION = os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #f62e6a3a11b9e0a1 — Environment-variable access.

repo/python/samples/demos/document_generator/main.py:55

AZURE_APP_INSIGHTS_CONNECTION_STRING = os.getenv("AZURE_APP_INSIGHTS_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #70043e79b7a91d44 — Filesystem access.

repo/python/samples/demos/document_generator/plugins/repo_file_plugin.py:22

            with open(path) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6c599f48bd0fceb5 — Filesystem access.

repo/python/samples/demos/document_generator/plugins/repo_file_plugin.py:37

                with open(os.path.join(root, file_name)) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5deba3d088de52b3 — Filesystem access.

repo/python/samples/getting_started_with_agents/azure_ai_agent/step06_azure_ai_agent_openapi.py:46

        with open(os.path.join(openapi_spec_file_path, "weather.json")) as weather_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #93bf0bd8d03b697a — Filesystem access.

repo/python/samples/getting_started_with_agents/azure_ai_agent/step06_azure_ai_agent_openapi.py:48

        with open(os.path.join(openapi_spec_file_path, "countries.json")) as countries_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c837efb1cac7807c — Environment-variable access.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/observability.py:21

APPINSIGHTS_CONNECTION_STRING = os.getenv("APPINSIGHTS_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c9ed0c0728b49056 — Filesystem access.

repo/python/samples/getting_started_with_agents/multi_agent_orchestration/step1a_concurrent_structured_outputs.py:73

    with open(os.path.join(os.path.dirname(__file__), "../resources", "Hamlet_full_play_summary.txt")) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #dff87d2c86b8ba42 — Filesystem access.

repo/python/samples/getting_started_with_agents/openai_assistant/step3_assistant_vision.py:26

    with open(file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9abf9375ab6c67a4 — Filesystem access.

repo/python/samples/getting_started_with_agents/openai_assistant/step5_assistant_tool_file_search.py:34

    with open(pdf_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d71e5a05068badce — Filesystem access.

repo/python/samples/getting_started_with_agents/openai_responses/step5_responses_agent_file_search.py:39

    with open(pdf_file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #db04c39fd4c6b754 — Filesystem access.

repo/python/samples/getting_started_with_processes/step03/step03a_food_preparation.py:88

    with open(file_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5bd3e19c58d165b9 — Filesystem access.

repo/python/samples/getting_started_with_processes/step03/step03a_food_preparation.py:104

        with open(file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7381aef6be91a25b — Filesystem access.

repo/python/samples/learn_resources/agent_docs/agent_collaboration.py:166

                with open(file_path, encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7353f5ca17c5f833 — Filesystem access.

repo/python/samples/learn_resources/agent_docs/assistant_code.py:54

        with open(file_path, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aead8fda24a469c1 — Filesystem access.

repo/python/samples/learn_resources/agent_docs/assistant_code.py:76

        with open(path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ddf415f913e29683 — Filesystem access.

repo/python/samples/learn_resources/agent_docs/assistant_search.py:45

        with open(path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #92100b77ed2ca53d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/learn_resources/plugins/GithubPlugin/github.py:116

        response = await client.get(path)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #7ba3df730df500f3 — Filesystem access.

repo/python/semantic_kernel/agents/agent.py:866

            with open(file_path, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e704d4918da12694 — Filesystem access.

repo/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:144

                "private_key": Path(self.client_cert_path).read_text(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cbe178f57c257c5c — Filesystem access.

repo/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:182

        pem_bytes = Path(cert_path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6bfb4c4aa2a632bb — Environment-variable access.

repo/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:390

        cache_file = environ.get("TOKEN_CACHE_PATH_INTERACTIVE") or path.join(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #eb567361bb98f6e8 — Filesystem access.

repo/python/semantic_kernel/connectors/ai/onnx/services/onnx_gen_ai_completion_base.py:43

            with open(json_gen_ai_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #9f2e24514f3c412e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/connectors/ai/open_ai/services/_open_ai_realtime.py:805

                session.post(self._get_webrtc_url(), headers=headers, data=offer.sdp) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #b9346c6b2755e20d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/connectors/ai/open_ai/services/_open_ai_realtime.py:902

                session.post(url, headers=headers, json=data) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #b4646ffebb05d9dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/connectors/ai/open_ai/services/azure_realtime.py:363

                session.post(url, headers=headers, json=data) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #db60c4d63a244e88 — Filesystem access.

repo/python/semantic_kernel/connectors/ai/open_ai/services/open_ai_handler.py:167

            with open(settings.filename, "rb") as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #18800c8a37b23cab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/connectors/brave.py:230

                response = await client.get(url, headers=headers, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #bcf3c27785affd0a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/connectors/google_search.py:268

                response = await client.get(full_url, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #e8e99507c8786db7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/connectors/memory_stores/astradb/astra_client.py:52

            session.post(request_url, data=json.dumps(query), headers=self.request_header) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #c4560bd191c4e7d6 — Environment-variable access.

repo/python/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:47

    elif os.getenv(ENV_VAR_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #044cd58064704a04 — Environment-variable access.

repo/python/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:48

        service_endpoint = os.getenv(ENV_VAR_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5e428f544f2312aa — Environment-variable access.

repo/python/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:63

    elif os.getenv(ENV_VAR_API_KEY):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2fe8137cf69e9530 — Environment-variable access.

repo/python/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:64

        azure_credential = AzureKeyCredential(os.getenv(ENV_VAR_API_KEY))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #939a94bdf74fef12 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/connectors/utils/document_loader.py:39

                response = await client.get(url, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #4d2072d6b903de28 — Filesystem access.

repo/python/semantic_kernel/contents/audio_content.py:83

        with open(path, "rb") as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #01b584a1f8f9ccf8 — Filesystem access.

repo/python/semantic_kernel/contents/binary_content.py:206

        data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5d483eaddbf98e75 — Filesystem access.

repo/python/semantic_kernel/contents/binary_content.py:257

        with open(path, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #dc98465fab39e453 — Filesystem access.

repo/python/semantic_kernel/contents/chat_history.py:422

        with open(file_path, "w") as local_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #800f8b7c40ac2332 — Filesystem access.

repo/python/semantic_kernel/contents/chat_history.py:437

        with open(file_path) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #41106e567f4390da — Filesystem access.

repo/python/semantic_kernel/contents/image_content.py:100

        with open(path, "rb") as image_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #ef4ba9b78f5c39a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/core_plugins/crew_ai/crew_ai_enterprise_client.py:47

            self.session.get(f"{self.endpoint}/inputs", headers=self.request_header) as response,  # type: ignore

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #e4161712364bd497 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/core_plugins/crew_ai/crew_ai_enterprise_client.py:77

            self.session.post(f"{self.endpoint}/kickoff", json=content, headers=self.request_header) as response,  # type: ignore

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #7851c2f456ee944a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/core_plugins/crew_ai/crew_ai_enterprise_client.py:93

            self.session.get(f"{self.endpoint}/status/{task_id}", headers=self.request_header) as response,  # type: ignore

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #6aaaf665567c2976 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/core_plugins/http_plugin.py:150

            session.get(url, raise_for_status=True, allow_redirects=self._allow_redirects) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #04da394cc1adf4a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/core_plugins/http_plugin.py:174

            session.post(
                url, headers=headers, data=data, raise_for_status=True, allow_redirects=self._allow_redirects
            ) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #e467e42d4f236256 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/semantic_kernel/core_plugins/http_plugin.py:201

            session.put(
                url, headers=headers, data=data, raise_for_status=True, allow_redirects=self._allow_redirects
            ) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #d1c6eaa6788a06f0 — Filesystem access.

repo/python/semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py:372

            with open(validated_path, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #21539aaec0985991 — Filesystem access.

repo/python/semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py:457

                with open(validated_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #33a5f4d2f6f8fa4f — Filesystem access.

repo/python/semantic_kernel/functions/kernel_function_from_prompt.py:399

        with open(config_path, encoding=encoding) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #32474364e451f929 — Filesystem access.

repo/python/semantic_kernel/functions/kernel_function_from_prompt.py:403

        with open(prompt_path, encoding=encoding) as prompt_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #076afa215133078b — Filesystem access.

repo/python/semantic_kernel/functions/kernel_plugin.py:322

                with open(object, encoding=encoding) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a5fe71ab2c380475 — Filesystem access.

repo/python/semantic_kernel/processes/kernel_process/kernel_process_step_state_metadata.py:69

            with open(file_path, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e0e796d4455da1db — Environment-variable access.

repo/python/semantic_kernel/utils/telemetry/user_agent.py:12

IS_TELEMETRY_ENABLED = os.environ.get(TELEMETRY_DISABLED_ENV_VAR, "false").lower() not in ["true", "1"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (python): python/samples/demos/mcp_with_oauth/server

python first-party

expand_more 1 low-confidence finding(s)

low egress test-only Excluded from app score #4b6a421d0b526dcc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/token_verifier.py:54

                response = await client.post(
                    self.introspection_endpoint,
                    data={"token": token},
                    headers={"Content-Type": "application/x-www-form-urlencoded"},
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

</> Dependencies

opentelemetry-sdk

python dependency

medium telemetry dependency Excluded from app score #7c193fbf24a97ecb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:20

from opentelemetry._logs import set_logger_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8b7cf38a44394a36 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:21

from opentelemetry.environment_variables import (
    OTEL_LOGS_EXPORTER,
    OTEL_METRICS_EXPORTER,
    OTEL_PYTHON_ID_GENERATOR,
    OTEL_TRACES_EXPORTER,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c0f1b67adf179560 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:27

from opentelemetry.metrics import set_meter_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5464a504d731a881 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:28

from opentelemetry.sdk._logs import (
    LoggerProvider,
    LoggingHandler,
    LogRecordProcessor,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5b90c4a6debf3968 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:33

from opentelemetry.sdk._logs._internal import _LoggerConfiguratorT

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #64e07c30893cf132 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:34

from opentelemetry.sdk._logs.export import (
    BatchLogRecordProcessor,
    LogRecordExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #17f243cdf0268804 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:38

from opentelemetry.sdk.environment_variables import (
    _OTEL_PYTHON_LOGGING_AUTO_INSTRUMENTATION_ENABLED,
    OTEL_CONFIG_FILE,
    OTEL_EXPORTER_OTLP_LOGS_PROTOCOL,
    OTEL_EXPORTER_OTLP_METRICS_PROTOCOL,
    OTEL_EXPORTER_OTLP_PROTOCOL,
    OTEL_EXPORTER_OTLP_TRACES_PROTOCOL,
    OTEL_PYTHON_LOGGER_CONFIGURATOR,
    OTEL_PYTHON_METER_CONFIGURATOR,
    OTEL_PYTHON_TRACER_CONFIGURATOR,
    OTEL_TRACES_SAMPLER,
    OTEL_TRACES_SAMPLER_ARG,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c7eea273c2a6fa05 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:51

from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ccd5f12698bb2be2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:52

from opentelemetry.sdk.metrics._internal import _MeterConfiguratorT

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fc5b450a9dd7b6cb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:53

from opentelemetry.sdk.metrics.export import (
    MetricExporter,
    MetricReader,
    PeriodicExportingMetricReader,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bd41a6cb0e5afd2a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:58

from opentelemetry.sdk.resources import Attributes, Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #571a963b998fdec6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:59

from opentelemetry.sdk.trace import (
    SpanProcessor,
    TracerProvider,
    _TracerConfiguratorT,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dde2f129c453ce6f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:64

from opentelemetry.sdk.trace.export import BatchSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5dfa3b461b9713c4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:65

from opentelemetry.sdk.trace.id_generator import IdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #389f591512a44978 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:66

from opentelemetry.sdk.trace.sampling import Sampler

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b4f9fc81d8e7219b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:67

from opentelemetry.semconv.resource import ResourceAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #068bd0b7bf3eda62 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:68

from opentelemetry.trace import set_tracer_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d0bd7ddf72615323 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:69

from opentelemetry.util._importlib_metadata import entry_points

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4e01be340f9af762 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:721

                from opentelemetry.configuration import (  # noqa: PLC0415
                    configure_sdk,
                    load_config_file,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ac5063ab980830f6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/__init__.py:4

from opentelemetry.sdk._logs._internal import (
    ConcurrentMultiLogRecordProcessor,
    LogDroppedAttributesWarning,
    Logger,
    LoggerProvider,
    LoggingHandler,
    LogLimits,
    LogRecordDroppedAttributesWarning,
    LogRecordLimits,
    LogRecordProcessor,
    ReadableLogRecord,
    ReadWriteLogRecord,
    SynchronousMultiLogRecordProcessor,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6c409e5dde7dab53 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:29

from opentelemetry._logs import Logger as APILogger

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cdfc7fb751d1953f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:30

from opentelemetry._logs import LoggerProvider as APILoggerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0eaa5639ab006207 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:31

from opentelemetry._logs import (
    LogRecord,
    NoOpLogger,
    SeverityNumber,
    get_logger,
    get_logger_provider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9ada2fc914316c92 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:38

from opentelemetry.attributes import _VALID_ANY_VALUE_TYPES, BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1f5200f84b951098 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:39

from opentelemetry.context import get_current

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7634cfc0e36d04d1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:40

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cc0dd388dd46fa0f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:41

from opentelemetry.metrics import MeterProvider, get_meter_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3fc0ce24d4496e6e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:42

from opentelemetry.sdk._logs._internal._exceptions import (
    _copy_log_record_with_exception,
    _create_log_record_with_exception,
    _set_log_record_exception_attributes,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #50a966119defe9e8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:47

from opentelemetry.sdk._logs._internal._logger_metrics import (
    LoggerMetricsT,
    create_logger_metrics,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4b109a4932f07582 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:51

from opentelemetry.sdk.environment_variables import (
    OTEL_ATTRIBUTE_COUNT_LIMIT,
    OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT,
    OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT,
    OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT,
    OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED,
    OTEL_SDK_DISABLED,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #336ccc3d181d2440 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:59

from opentelemetry.sdk.environment_variables._internal import (
    parse_boolean_environment_variable,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b9145e25052b356e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:62

from opentelemetry.sdk.resources import (
    Resource,
    _get_process_dependent_resource,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ffab8cd3fc171ff4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:66

from opentelemetry.sdk.util import ns_to_iso_str

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6cf24d524a9ea73e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:67

from opentelemetry.sdk.util._configurator import RuleBasedConfigurator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #09d9db7649339a4f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:68

from opentelemetry.sdk.util.instrumentation import (
    InstrumentationScope,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #228682d7e2bb2ae8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:71

from opentelemetry.semconv._incubating.attributes import code_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1e4d763ff3a312b8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:72

from opentelemetry.semconv.attributes import exception_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a9da2b76744d44d8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:73

from opentelemetry.trace import (
    format_span_id,
    format_trace_id,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a324ec24a6ebbcd9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:77

from opentelemetry.util.types import AnyValue, _ExtendedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #46c1a5be9205fabd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/_exceptions.py:7

from opentelemetry._logs import LogRecord

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d242ae41a1436ec1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/_exceptions.py:8

from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8a3c3d4e69cd9a7c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/_exceptions.py:9

from opentelemetry.semconv.attributes import exception_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e1afe00ea86562d3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/_exceptions.py:10

from opentelemetry.util.types import AnyValue, _ExtendedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #63cd74d996ae0232 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/_logger_metrics.py:6

from opentelemetry import metrics as metrics_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f6382b2cd548f750 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/_logger_metrics.py:7

from opentelemetry.semconv._incubating.metrics.otel_metrics import (
    create_otel_sdk_log_created,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c4ff42c06e0c17ca — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:16

from opentelemetry.context import (
    _ON_EMIT_RECURSION_COUNT_KEY,
    _SUPPRESS_INSTRUMENTATION_KEY,
    Context,
    attach,
    detach,
    get_value,
    set_value,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e1cdf2487c9fb34b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:25

from opentelemetry.metrics import MeterProvider, get_meter_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #69b87a83eb6ed414 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:26

from opentelemetry.sdk._logs import (
    LogRecordProcessor,
    ReadableLogRecord,
    ReadWriteLogRecord,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #10366f5e22bb67e0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:31

from opentelemetry.sdk._shared_internal import (
    BatchProcessor,
    DuplicateFilter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #047b8397e24a7e12 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:35

from opentelemetry.sdk._shared_internal._processor_metrics import (
    create_processor_metrics,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #01e6e8d45d1f28e8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:38

from opentelemetry.sdk.environment_variables import (
    OTEL_BLRP_EXPORT_TIMEOUT,
    OTEL_BLRP_MAX_EXPORT_BATCH_SIZE,
    OTEL_BLRP_MAX_QUEUE_SIZE,
    OTEL_BLRP_SCHEDULE_DELAY,
    OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #641f73caa945cd89 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:45

from opentelemetry.sdk.environment_variables._internal import (
    parse_boolean_environment_variable,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #244f7d0931ce9c01 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:48

from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0bab45104ac6c7fe — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:49

from opentelemetry.semconv._incubating.attributes.otel_attributes import (
    OtelComponentTypeValues,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3e544adaef5a899f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/in_memory_log_exporter.py:9

from opentelemetry.sdk._logs import ReadableLogRecord

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d7d96f65b230218c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/in_memory_log_exporter.py:10

from opentelemetry.sdk._logs.export import (
    LogRecordExporter,
    LogRecordExportResult,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b6a4f3c9c5cc4caa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/export/__init__.py:4

from opentelemetry.sdk._logs._internal.export import (
    BatchLogRecordProcessor,
    ConsoleLogExporter,
    ConsoleLogRecordExporter,
    LogExporter,
    LogExportResult,
    LogRecordExporter,
    LogRecordExportResult,
    SimpleLogRecordProcessor,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #745cb7c198b1d9d0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/export/__init__.py:16

from opentelemetry.sdk._logs._internal.export.in_memory_log_exporter import (
    InMemoryLogExporter,
    InMemoryLogRecordExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e73d3cd0f5cdd35b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_shared_internal/__init__.py:21

from opentelemetry.context import (
    _SUPPRESS_INSTRUMENTATION_KEY,
    attach,
    detach,
    set_value,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #795622bb40440c73 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_shared_internal/__init__.py:27

from opentelemetry.sdk._shared_internal._processor_metrics import (
    ProcessorMetricsT,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8a763b0c89369e29 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_shared_internal/__init__.py:30

from opentelemetry.util._once import Once

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #29e837f022399e98 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_shared_internal/_processor_metrics.py:10

from opentelemetry.metrics import CallbackOptions, MeterProvider, Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2a5d6550e17c54fa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_shared_internal/_processor_metrics.py:11

from opentelemetry.semconv._incubating.attributes.otel_attributes import (
    OTEL_COMPONENT_NAME,
    OTEL_COMPONENT_TYPE,
    OtelComponentTypeValues,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5ad7737b3c11ec1a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_shared_internal/_processor_metrics.py:16

from opentelemetry.semconv._incubating.metrics.otel_metrics import (
    OTEL_SDK_PROCESSOR_LOG_QUEUE_SIZE,
    OTEL_SDK_PROCESSOR_SPAN_QUEUE_SIZE,
    create_otel_sdk_processor_log_processed,
    create_otel_sdk_processor_log_queue_capacity,
    create_otel_sdk_processor_span_processed,
    create_otel_sdk_processor_span_queue_capacity,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0eb4134bc2aee5f3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/_shared_internal/_processor_metrics.py:24

from opentelemetry.semconv.attributes.error_attributes import ERROR_TYPE

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7ef193071aaa0e45 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/error_handler/__init__.py:54

from opentelemetry.util._importlib_metadata import entry_points

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ed36f9c0bf17aae6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/__init__.py:5

from opentelemetry.sdk.metrics import export, view

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #412536492655aec7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/__init__.py:6

from opentelemetry.sdk.metrics._internal import Meter, MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b7dacb248d4d6db6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/__init__.py:7

from opentelemetry.sdk.metrics._internal.exceptions import MetricsTimeoutError

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3ecb111fb830abd1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/__init__.py:8

from opentelemetry.sdk.metrics._internal.exemplar import (
    AlignedHistogramBucketExemplarReservoir,
    AlwaysOffExemplarFilter,
    AlwaysOnExemplarFilter,
    Exemplar,
    ExemplarFilter,
    ExemplarReservoir,
    SimpleFixedSizeExemplarReservoir,
    TraceBasedExemplarFilter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8229cfec5b5292dd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/__init__.py:18

from opentelemetry.sdk.metrics._internal.instrument import (
    Counter,
    Histogram,
    ObservableCounter,
    ObservableGauge,
    ObservableUpDownCounter,
    UpDownCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #431beeeba153360c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/__init__.py:26

from opentelemetry.sdk.metrics._internal.instrument import Gauge as _Gauge

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bd223263d803bb33 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:15

import opentelemetry.sdk.metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #93cf99d5f895afa6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:16

from opentelemetry.metrics import Counter as APICounter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fef3c86366a24ceb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:17

from opentelemetry.metrics import Histogram as APIHistogram

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #660d6d5a8f8e2b0b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:18

from opentelemetry.metrics import Meter as APIMeter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e9933dbe563b863b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:19

from opentelemetry.metrics import MeterProvider as APIMeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8e86b4facf7c5cb8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:20

from opentelemetry.metrics import NoOpMeter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9ac8891320691f9a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:21

from opentelemetry.metrics import ObservableCounter as APIObservableCounter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5f1c92bdc5a8fde5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:22

from opentelemetry.metrics import ObservableGauge as APIObservableGauge

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9617231b9451e12c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:23

from opentelemetry.metrics import (
    ObservableUpDownCounter as APIObservableUpDownCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4709bdeb9f215b5a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:26

from opentelemetry.metrics import UpDownCounter as APIUpDownCounter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #514473a4fac32830 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:27

from opentelemetry.metrics import _Gauge as APIGauge

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5c450dc3f9aa177c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:28

from opentelemetry.sdk.environment_variables import (
    OTEL_METRICS_EXEMPLAR_FILTER,
    OTEL_SDK_DISABLED,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #86e20346bae011c1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:32

from opentelemetry.sdk.metrics._internal.exceptions import MetricsTimeoutError

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #38f5e29ac2e70632 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:33

from opentelemetry.sdk.metrics._internal.exemplar import (
    AlwaysOffExemplarFilter,
    AlwaysOnExemplarFilter,
    ExemplarFilter,
    TraceBasedExemplarFilter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #65e4f3f52954c80d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:39

from opentelemetry.sdk.metrics._internal.instrument import (
    _Counter,
    _Gauge,
    _Histogram,
    _ObservableCounter,
    _ObservableGauge,
    _ObservableUpDownCounter,
    _UpDownCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6d43a4ea06d70ed6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:48

from opentelemetry.sdk.metrics._internal.measurement_consumer import (
    MeasurementConsumer,
    SynchronousMeasurementConsumer,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #95467afef48f0db0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:52

from opentelemetry.sdk.metrics._internal.sdk_configuration import (
    SdkConfiguration,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ecb78bca129b0308 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:55

from opentelemetry.sdk.resources import (
    Resource,
    _get_process_dependent_resource,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #44f321cd3e33a949 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:59

from opentelemetry.sdk.util._configurator import RuleBasedConfigurator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #507569c72b0f7ffa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:60

from opentelemetry.sdk.util.instrumentation import (
    InstrumentationScope,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #697e5cef5896cb3c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:63

from opentelemetry.util._once import Once

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #11f2427d33c7ccdf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:64

from opentelemetry.util.types import (
    Attributes,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3e1bcfa1102e8d1d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/_view_instrument_match.py:11

from opentelemetry.sdk.metrics._internal.aggregation import (
    Aggregation,
    AggregationTemporality,
    DefaultAggregation,
    _Aggregation,
    _SumAggregation,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4cf48b597704d519 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/_view_instrument_match.py:18

from opentelemetry.sdk.metrics._internal.instrument import _Instrument

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e7c0fd176a3b73a4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/_view_instrument_match.py:19

from opentelemetry.sdk.metrics._internal.measurement import Measurement

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9e6fda894c22f3f2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/_view_instrument_match.py:20

from opentelemetry.sdk.metrics._internal.point import DataPointT

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #de24acd01e4e0fa1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/_view_instrument_match.py:21

from opentelemetry.sdk.metrics._internal.view import View

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #56531ab11f9e324d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:20

from opentelemetry.metrics import (
    Asynchronous,
    Counter,
    Histogram,
    ObservableCounter,
    ObservableGauge,
    ObservableUpDownCounter,
    Synchronous,
    UpDownCounter,
    _Gauge,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ed98aac350c66879 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:31

from opentelemetry.sdk.metrics._internal.exemplar import (
    Exemplar,
    ExemplarReservoirBuilder,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1f49aa7cc2838046 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:35

from opentelemetry.sdk.metrics._internal.exponential_histogram.buckets import (
    Buckets,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #12ae1217e14032a9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:38

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping import (
    Mapping,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2f676d53f74813c0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:41

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping.exponent_mapping import (
    ExponentMapping,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #78b9108c433a5cd5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:44

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping.logarithm_mapping import (
    LogarithmMapping,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4470cbf73f5e97de — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:47

from opentelemetry.sdk.metrics._internal.instrument import _Instrument

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c2879bc719972442 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:48

from opentelemetry.sdk.metrics._internal.measurement import Measurement

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5faeba6200c7e8fa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:49

from opentelemetry.sdk.metrics._internal.point import Buckets as BucketsPoint

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1ed5ba791a037646 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:50

from opentelemetry.sdk.metrics._internal.point import (
    ExponentialHistogramDataPoint,
    HistogramDataPoint,
    NumberDataPoint,
    Sum,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2bec6f88034045c8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:56

from opentelemetry.sdk.metrics._internal.point import Gauge as GaugePoint

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a709da3c59fcd980 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:57

from opentelemetry.sdk.metrics._internal.point import (
    Histogram as HistogramPoint,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #696c98cf03423dc0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/aggregation.py:60

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #70084a25197e1d62 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar.py:6

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e1849460aaeb1a39 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_filter.py:6

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5525660542fb47e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_filter.py:7

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4a446edce2be36f8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_filter.py:8

from opentelemetry.trace.span import INVALID_SPAN

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4248362da110db9b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_filter.py:9

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #78dbb30c0a9f59a4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_reservoir.py:12

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2a3726434662d876 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_reservoir.py:13

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3708261ecd9b71c5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_reservoir.py:14

from opentelemetry.trace.span import INVALID_SPAN

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #37977dd93b7c9e25 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exemplar/exemplar_reservoir.py:15

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9dbdd173ed593ee2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exponential_histogram/mapping/exponent_mapping.py:7

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping import (
    Mapping,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #97a4afbef5246fc4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exponential_histogram/mapping/exponent_mapping.py:10

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping.errors import (
    MappingOverflowError,
    MappingUnderflowError,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #345affea62a695cc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exponential_histogram/mapping/exponent_mapping.py:14

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping.ieee_754 import (
    MANTISSA_WIDTH,
    MAX_NORMAL_EXPONENT,
    MIN_NORMAL_EXPONENT,
    MIN_NORMAL_VALUE,
    get_ieee_754_exponent,
    get_ieee_754_mantissa,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b9ce2566ccb3b696 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exponential_histogram/mapping/logarithm_mapping.py:7

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping import (
    Mapping,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d2e567d2c52efe5d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exponential_histogram/mapping/logarithm_mapping.py:10

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping.errors import (
    MappingOverflowError,
    MappingUnderflowError,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4f41d6594337eb87 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/exponential_histogram/mapping/logarithm_mapping.py:14

from opentelemetry.sdk.metrics._internal.exponential_histogram.mapping.ieee_754 import (
    MAX_NORMAL_EXPONENT,
    MIN_NORMAL_EXPONENT,
    MIN_NORMAL_VALUE,
    get_ieee_754_exponent,
    get_ieee_754_mantissa,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #62f50c22783f5d2d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:21

import opentelemetry.sdk.metrics._internal

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2fc2023aa138119e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:22

from opentelemetry.context import (
    _SUPPRESS_INSTRUMENTATION_KEY,
    attach,
    detach,
    set_value,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #792bc119f9faa11a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:28

from opentelemetry.metrics import MeterProvider, NoOpMeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #87976ba1d262ff9b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:29

from opentelemetry.sdk.environment_variables import (
    OTEL_METRIC_EXPORT_INTERVAL,
    OTEL_METRIC_EXPORT_TIMEOUT,
    OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1ae3b42a82a66d4e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:34

from opentelemetry.sdk.environment_variables._internal import (
    parse_boolean_environment_variable,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #abcb30ecd871835d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:37

from opentelemetry.sdk.metrics._internal.aggregation import (
    AggregationTemporality,
    DefaultAggregation,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7d88627ef71d0474 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:41

from opentelemetry.sdk.metrics._internal.exceptions import MetricsTimeoutError

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #19d8872f035bc170 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:42

from opentelemetry.sdk.metrics._internal.instrument import (
    Counter,
    Gauge,
    Histogram,
    ObservableCounter,
    ObservableGauge,
    ObservableUpDownCounter,
    UpDownCounter,
    _Counter,
    _Gauge,
    _Histogram,
    _ObservableCounter,
    _ObservableGauge,
    _ObservableUpDownCounter,
    _UpDownCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a1731def4ebefbce — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:58

from opentelemetry.sdk.metrics._internal.point import MetricsData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7872a37debad3d5c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:59

from opentelemetry.semconv._incubating.attributes.otel_attributes import (
    OtelComponentTypeValues,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #428fb7367e788143 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:62

from opentelemetry.util._once import Once

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2b7cb42960837984 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/_metric_reader_metrics.py:7

from opentelemetry.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #29097a225327be10 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/_metric_reader_metrics.py:8

from opentelemetry.semconv._incubating.attributes.otel_attributes import (
    OTEL_COMPONENT_NAME,
    OTEL_COMPONENT_TYPE,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9a415eae0c570d25 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/_metric_reader_metrics.py:12

from opentelemetry.semconv._incubating.metrics.otel_metrics import (
    create_otel_sdk_metric_reader_collection_duration,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #174a469484b5c26b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:19

from opentelemetry.context import Context, get_current

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4d5f462d290a0531 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:20

from opentelemetry.metrics import Asynchronous, CallbackT, Synchronous

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #eefc72cebf72d921 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:21

from opentelemetry.metrics import Counter as APICounter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f64b5153b18c6162 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:22

from opentelemetry.metrics import Histogram as APIHistogram

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2318d3e6c8306d18 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:23

from opentelemetry.metrics import ObservableCounter as APIObservableCounter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c271ba502985ab5f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:24

from opentelemetry.metrics import ObservableGauge as APIObservableGauge

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ce8a13502cf884f3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:25

from opentelemetry.metrics import (
    ObservableUpDownCounter as APIObservableUpDownCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5b20ba3a117d5e4b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:28

from opentelemetry.metrics import UpDownCounter as APIUpDownCounter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2564d17f400b09f1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:29

from opentelemetry.metrics import _Gauge as APIGauge

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #401284008405e5e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:30

from opentelemetry.metrics._internal.instrument import (
    CallbackOptions,
    _MetricsHistogramAdvisory,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #68e51411ff74e700 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:34

from opentelemetry.sdk.metrics._internal.measurement import Measurement

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b91561137b6a06b4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:37

    from opentelemetry.sdk.metrics._internal import (
        _ProxyMeterConfig,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #08a9eab51a638b79 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:40

    from opentelemetry.sdk.metrics._internal.measurement_consumer import (
        MeasurementConsumer,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7f1b9fb692b86fbe — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/instrument.py:43

    from opentelemetry.sdk.util.instrumentation import InstrumentationScope

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #af2fe8fd70562b77 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement.py:9

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #216666c4ad80b1e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement.py:10

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2b01323da70ae7c4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement.py:13

    from opentelemetry.sdk.metrics._internal.instrument import _Instrument

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dddc174324be9daa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement_consumer.py:12

import opentelemetry.sdk.metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ad71d5fe8ae3fc60 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement_consumer.py:13

import opentelemetry.sdk.metrics._internal.instrument

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2e98a67d3e952281 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement_consumer.py:14

from opentelemetry.metrics._internal.instrument import CallbackOptions

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6ea91b9bdb6ee4b0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement_consumer.py:15

from opentelemetry.sdk.metrics._internal.exceptions import MetricsTimeoutError

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #613c394d07359367 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement_consumer.py:16

from opentelemetry.sdk.metrics._internal.measurement import Measurement

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9687d620b76bd646 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement_consumer.py:17

from opentelemetry.sdk.metrics._internal.metric_reader_storage import (
    MetricReaderStorage,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #93db0c52841ce083 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/measurement_consumer.py:20

from opentelemetry.sdk.metrics._internal.point import MetricsData

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1984ff8bbf6b8bb6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:8

from opentelemetry.metrics import (
    Asynchronous,
    Counter,
    ObservableCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #08a8c8f6cf9228b8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:13

from opentelemetry.sdk.metrics._internal._view_instrument_match import (
    _ViewInstrumentMatch,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ab7f831be359edc8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:16

from opentelemetry.sdk.metrics._internal.aggregation import (
    Aggregation,
    AggregationTemporality,
    ExplicitBucketHistogramAggregation,
    _DropAggregation,
    _ExplicitBucketHistogramAggregation,
    _ExponentialBucketHistogramAggregation,
    _LastValueAggregation,
    _SumAggregation,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9dba33c3f50cefbf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:26

from opentelemetry.sdk.metrics._internal.instrument import _Instrument

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7c61fa8dbb128f87 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:27

from opentelemetry.sdk.metrics._internal.measurement import Measurement

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #650e526ad97ca32e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:28

from opentelemetry.sdk.metrics._internal.point import (
    ExponentialHistogram,
    Gauge,
    Histogram,
    Metric,
    MetricsData,
    ResourceMetrics,
    ScopeMetrics,
    Sum,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7f6571492aae691d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:38

from opentelemetry.sdk.metrics._internal.sdk_configuration import (
    SdkConfiguration,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f6ca91d08f21b98d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:41

from opentelemetry.sdk.metrics._internal.view import View

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #feb90a0b8f797d4f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/metric_reader_storage.py:42

from opentelemetry.sdk.util.instrumentation import InstrumentationScope

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #361f027eca667cc3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/point.py:11

import opentelemetry.sdk.metrics._internal

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8b94e654eba83420 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/point.py:12

from opentelemetry.sdk.metrics._internal.exemplar import Exemplar

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #16eaca623180f70c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/point.py:13

from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #07a02965a23df588 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/point.py:14

from opentelemetry.sdk.util.instrumentation import InstrumentationScope

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ec247a87c5b25902 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/point.py:15

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4b10ebf7e19413fd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/sdk_configuration.py:10

import opentelemetry.sdk.metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #38a08a635fe9e2b4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/sdk_configuration.py:11

import opentelemetry.sdk.resources

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #148be3eedc603f20 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/view.py:9

from opentelemetry.metrics import Instrument

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9dda4d990e9e37da — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/view.py:10

from opentelemetry.sdk.metrics._internal.aggregation import (
    Aggregation,
    DefaultAggregation,
    _Aggregation,
    _ExplicitBucketHistogramAggregation,
    _ExponentialBucketHistogramAggregation,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9491abbd2c4431bc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/view.py:17

from opentelemetry.sdk.metrics._internal.exemplar import (
    AlignedHistogramBucketExemplarReservoir,
    ExemplarReservoirBuilder,
    SimpleFixedSizeExemplarReservoir,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dc8d0f63ec7b9415 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/view.py:22

from opentelemetry.sdk.metrics._internal.instrument import _Instrument

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4d9bb706011d51bd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/export/__init__.py:5

from opentelemetry.sdk.metrics._internal.aggregation import (
    AggregationTemporality,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #09812d4a51d241ed — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/export/__init__.py:8

from opentelemetry.sdk.metrics._internal.export import (
    ConsoleMetricExporter,
    InMemoryMetricReader,
    MetricExporter,
    MetricExportResult,
    MetricReader,
    PeriodicExportingMetricReader,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3a8ef2a65bbe21c8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/export/__init__.py:18

from opentelemetry.sdk.metrics._internal.point import (  # noqa: F401
    Buckets,
    DataPointT,
    DataT,
    ExponentialHistogram,
    ExponentialHistogramDataPoint,
    Gauge,
    Histogram,
    HistogramDataPoint,
    Metric,
    MetricsData,
    NumberDataPoint,
    ResourceMetrics,
    ScopeMetrics,
    Sum,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0319f0bbdb3d83bc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/view/__init__.py:4

from opentelemetry.sdk.metrics._internal.aggregation import (
    Aggregation,
    DefaultAggregation,
    DropAggregation,
    ExplicitBucketHistogramAggregation,
    ExponentialBucketHistogramAggregation,
    LastValueAggregation,
    SumAggregation,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7ec89a1dff685b25 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/view/__init__.py:13

from opentelemetry.sdk.metrics._internal.view import View

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2943a546384079f1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:67

from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5742edb9cb1e4d30 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:68

from opentelemetry.sdk.environment_variables import (
    OTEL_EXPERIMENTAL_RESOURCE_DETECTORS,
    OTEL_RESOURCE_ATTRIBUTES,
    OTEL_SERVICE_NAME,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #424ae1bab96b12ee — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:73

from opentelemetry.sdk.version import (
    __version__ as _OPENTELEMETRY_SDK_VERSION,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a99f3f4200a49e98 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:76

from opentelemetry.semconv.resource import ResourceAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0091ccca2c6a33dc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:77

from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #723a3bed0ba6294a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:571

    from opentelemetry.util._importlib_metadata import (  # noqa: PLC0415
        entry_points,  # type: ignore[reportUnknownVariableType]

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #61b97a76b3d55bea — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:33

from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #56f3275a5f3bdfb7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:34

from opentelemetry import metrics as metrics_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d914ccbb7436c8b9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:35

from opentelemetry import trace as trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #beb5ce1b7c945969 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:36

from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fc5d612b03f5ed50 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:37

from opentelemetry.sdk import util

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c6b813809ac5c879 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:38

from opentelemetry.sdk.environment_variables import (
    OTEL_ATTRIBUTE_COUNT_LIMIT,
    OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT,
    OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT,
    OTEL_LINK_ATTRIBUTE_COUNT_LIMIT,
    OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED,
    OTEL_SDK_DISABLED,
    OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT,
    OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT,
    OTEL_SPAN_EVENT_COUNT_LIMIT,
    OTEL_SPAN_LINK_COUNT_LIMIT,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #24d13c34a1ff7c07 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:50

from opentelemetry.sdk.environment_variables._internal import (
    parse_boolean_environment_variable,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #104ad7bb26cf8f67 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:53

from opentelemetry.sdk.resources import (
    Resource,
    _get_process_dependent_resource,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2735f8a5b269f31e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:57

from opentelemetry.sdk.trace import sampling

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e6f4208dbddb3f3b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:58

from opentelemetry.sdk.trace._tracer_metrics import create_tracer_metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7cde97ec8a049704 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:59

from opentelemetry.sdk.trace.id_generator import IdGenerator, RandomIdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3f762559ed474c46 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:60

from opentelemetry.sdk.util import BoundedList

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0cdf0f6407df4636 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:61

from opentelemetry.sdk.util._configurator import RuleBasedConfigurator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #51df8faff95c1f32 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:62

from opentelemetry.sdk.util.instrumentation import (
    InstrumentationInfo,
    InstrumentationScope,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #97e86f27981cad18 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:66

from opentelemetry.semconv.attributes.exception_attributes import (
    EXCEPTION_ESCAPED,
    EXCEPTION_MESSAGE,
    EXCEPTION_STACKTRACE,
    EXCEPTION_TYPE,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5cc88951ea166fb8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:72

from opentelemetry.trace import NoOpTracer, SpanContext

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f209c00893ac6103 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:73

from opentelemetry.trace.status import Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #934b2898707133fa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:74

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c3e8152601e705f7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:75

from opentelemetry.util._decorator import _agnosticcontextmanager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #490de6e448739889 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_always_off.py:8

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #61848af4ad642291 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_always_off.py:9

from opentelemetry.trace import Link, SpanKind, TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fe0e6fb9d04ebf2f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_always_off.py:10

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d756c6344856a9df — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_always_on.py:8

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4236fa29cb19e313 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_always_on.py:9

from opentelemetry.trace import Link, SpanKind, TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ff48e7068233cb9e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_always_on.py:10

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ba083d3846a3fcaa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_composable.py:10

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bde03f237dfff69d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_composable.py:11

from opentelemetry.trace import Link, SpanKind, TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e306077db60e60d4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_composable.py:12

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1e8bc4e7cfb3dbea — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_parent_threshold.py:8

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c9a4729b8821dd2d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_parent_threshold.py:9

from opentelemetry.trace import Link, SpanKind, TraceState, get_current_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2be3646f2d6d8966 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_parent_threshold.py:10

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7b368fa617c4a1bd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_rule_based.py:11

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bde82ebdc3c120d5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_rule_based.py:12

from opentelemetry.trace import (
    Link,
    SpanKind,
    TraceState,
    get_current_span,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b193a22cc742e7d1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_rule_based.py:18

from opentelemetry.util.types import AnyValue, Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #79478c5941d408f3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_sampler.py:8

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e7d7fd24c12ec77b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_sampler.py:9

from opentelemetry.sdk.trace.sampling import Decision, Sampler, SamplingResult

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d7cead66c0b84f94 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_sampler.py:10

from opentelemetry.trace import Link, SpanKind, TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c34b687b49b835f1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_sampler.py:11

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0c28b03e7bb08cde — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_trace_state.py:9

from opentelemetry.trace import TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #71becc230e340898 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_traceid_ratio.py:8

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f222100deddb870c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_traceid_ratio.py:9

from opentelemetry.trace import Link, SpanKind, TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e3d25f3a6a67099f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_sampling_experimental/_traceid_ratio.py:10

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5a708b25adb45ae4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_tracer_metrics.py:9

from opentelemetry import metrics as metrics_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e4eef4aeda018912 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_tracer_metrics.py:10

from opentelemetry.sdk.trace.sampling import Decision

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9da5691b7888d9ed — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_tracer_metrics.py:11

from opentelemetry.semconv._incubating.attributes.otel_attributes import (
    OTEL_SPAN_PARENT_ORIGIN,
    OTEL_SPAN_SAMPLING_RESULT,
    OtelSpanSamplingResultValues,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b49eca09a8a35e88 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_tracer_metrics.py:16

from opentelemetry.semconv._incubating.metrics.otel_metrics import (
    create_otel_sdk_span_live,
    create_otel_sdk_span_started,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #16578fe09b3f0ff7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/_tracer_metrics.py:20

from opentelemetry.trace.span import SpanContext

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #253645dd3b826d30 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:12

from opentelemetry.context import (
    _SUPPRESS_INSTRUMENTATION_KEY,
    Context,
    attach,
    detach,
    set_value,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6567fe408ca065dc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:19

from opentelemetry.metrics import MeterProvider, get_meter_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #25455f7c17d38278 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:20

from opentelemetry.sdk._shared_internal import (
    BatchProcessor,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #50c18850030ed05f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:23

from opentelemetry.sdk._shared_internal._processor_metrics import (
    create_processor_metrics,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ea638bff2cab9255 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:26

from opentelemetry.sdk.environment_variables import (
    OTEL_BSP_EXPORT_TIMEOUT,
    OTEL_BSP_MAX_EXPORT_BATCH_SIZE,
    OTEL_BSP_MAX_QUEUE_SIZE,
    OTEL_BSP_SCHEDULE_DELAY,
    OTEL_PYTHON_SDK_INTERNAL_METRICS_ENABLED,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #44b85128fc4c87f4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:33

from opentelemetry.sdk.environment_variables._internal import (
    parse_boolean_environment_variable,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b6078609bd45ef37 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:36

from opentelemetry.sdk.trace import ReadableSpan, Span, SpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #14b4cf5c5c33b7fd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:37

from opentelemetry.semconv._incubating.attributes.otel_attributes import (
    OtelComponentTypeValues,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d041776564155dfc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/in_memory_span_exporter.py:8

from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bc65d6b84475962e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/in_memory_span_exporter.py:9

from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0c7911b6abe3ac9d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/id_generator.py:7

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f36c7b4b3ff62e93 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/sampling.py:135

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d720404c08094cb9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/sampling.py:136

from opentelemetry.sdk.environment_variables import (
    OTEL_TRACES_SAMPLER,
    OTEL_TRACES_SAMPLER_ARG,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1df034cf318583ca — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/sampling.py:140

from opentelemetry.trace import Link, SpanKind, get_current_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7bedcbf8c6d50e0a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/sampling.py:141

from opentelemetry.trace.span import TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5d8d9e324b75928b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/sampling.py:142

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ecc5d1c097e2c99d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/util/__init__.pyi:28

from opentelemetry.util.types import AttributesAsKey, AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3917365081ed7821 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/util/_configurator.py:6

from opentelemetry.sdk.util.instrumentation import (
    InstrumentationScope,
    _InstrumentationScopePredicateT,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2229d827ac06dd60 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/util/instrumentation.py:9

from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b6ac04288fbfb248 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/sdk/util/instrumentation.py:10

from opentelemetry.util.types import (  # TODO: see if we can remove F401 when using new sphinx version # noqa: F401 # pylint: disable=unused-import
    AnyValue,
    Attributes,
    _ExtendedAttributes,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 44 low-confidence finding(s)

low env_fs dependency Excluded from app score #5ee0e22c2425296c — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:154

    return environ.get(OTEL_TRACES_SAMPLER, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca85dc284f1d6e41 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:158

    return environ.get(OTEL_PYTHON_ID_GENERATOR, _DEFAULT_ID_GENERATOR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8094a2e0a0eeb7d0 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:162

    return environ.get(OTEL_PYTHON_TRACER_CONFIGURATOR, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0853074fe46f6db — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:166

    return environ.get(OTEL_PYTHON_METER_CONFIGURATOR, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0cb24543de45243 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:170

    return environ.get(OTEL_PYTHON_LOGGER_CONFIGURATOR, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f21f70419a8aedd — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:184

    otlp_protocol = environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfd27a32f812bf90 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:184

    otlp_protocol = environ.get(
        _PROTOCOL_ENV_BY_SIGNAL_TYPE[signal_type]
    ) or environ.get(OTEL_EXPORTER_OTLP_PROTOCOL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #398648089ed9cd3d — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:186

    ) or environ.get(OTEL_EXPORTER_OTLP_PROTOCOL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b932ae462d1c7fb5 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:220

    names = environ.get(_EXPORTER_ENV_BY_SIGNAL_TYPE.get(signal_type, ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e65fb9b8ec9746b — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:492

                rate = float(os.getenv(OTEL_TRACES_SAMPLER_ARG, ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ec04b65bde8ec51 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:500

            arg = os.getenv(OTEL_TRACES_SAMPLER_ARG)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5611354a23228351 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:649

            os.getenv(
                _OTEL_PYTHON_LOGGING_AUTO_INSTRUMENTATION_ENABLED, "false"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90521dba2e40a938 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_configuration/__init__.py:710

        if config_file := environ.get(OTEL_CONFIG_FILE):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09710cad2e48c1d1 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:202

            if env_var not in environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cc4c4f189b18ded — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:205

            str_value = environ.get(env_var, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee5fc640dd1477eb — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/__init__.py:835

        disabled = environ.get(OTEL_SDK_DISABLED, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #489e57aef4fd1891 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:363

                environ.get(OTEL_BLRP_MAX_QUEUE_SIZE, _DEFAULT_MAX_QUEUE_SIZE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53bc356dbe2e7c8b — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:377

                environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b89a68cf2fccb9c0 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:377

                environ.get(
                    OTEL_BLRP_SCHEDULE_DELAY, _DEFAULT_SCHEDULE_DELAY_MILLIS
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #872a0a81164b1736 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:393

                environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7533e85a2af39c5e — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:393

                environ.get(
                    OTEL_BLRP_MAX_EXPORT_BATCH_SIZE,
                    _DEFAULT_MAX_EXPORT_BATCH_SIZE,
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f72218d67bc01d5 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:410

                environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab65608360f1cc3d — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/_logs/_internal/export/__init__.py:410

                environ.get(
                    OTEL_BLRP_EXPORT_TIMEOUT, _DEFAULT_EXPORT_TIMEOUT_MILLIS
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ecf195eab8aa59e2 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/environment_variables/_internal.py:13

    value = environ.get(environment_variable)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #233bd413ff47dd8d — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:493

                    environ.get(OTEL_METRICS_EXEMPLAR_FILTER, "trace_based")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6397e5813325a22c — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/__init__.py:504

        disabled = environ.get(OTEL_SDK_DISABLED, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa63279f8d5d0237 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:498

                    environ.get(OTEL_METRIC_EXPORT_INTERVAL, 60000)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fc78a5c39c143b5 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/metrics/_internal/export/__init__.py:508

                    environ.get(OTEL_METRIC_EXPORT_TIMEOUT, 30000)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92fdeef53dfeeb13 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:315

        env_resources_items = environ.get(OTEL_RESOURCE_ATTRIBUTES)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d9835bf8e75ca0d — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:332

        service_name = environ.get(OTEL_SERVICE_NAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #802fc18d331c552d — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:557

                for name in environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4dcaba686a26277 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/resources/__init__.py:557

                for name in environ.get(
                    OTEL_EXPERIMENTAL_RESOURCE_DETECTORS, ""
                ).split(",")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a7606b7ed4ad8fe — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:738

            if env_var not in environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fe3d69809d5e894 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:741

            str_value = environ.get(env_var, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f46cd38a5229ad1 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/__init__.py:1341

        disabled = environ.get(OTEL_SDK_DISABLED, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ba8629dba257452 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:242

                environ.get(OTEL_BSP_MAX_QUEUE_SIZE, _DEFAULT_MAX_QUEUE_SIZE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9d320490a0f0be9 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:256

                environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90af789a3ecc925f — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:256

                environ.get(
                    OTEL_BSP_SCHEDULE_DELAY, _DEFAULT_SCHEDULE_DELAY_MILLIS
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c14d11d8ff6e886 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:272

                environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee4a41583a0c040d — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:272

                environ.get(
                    OTEL_BSP_MAX_EXPORT_BATCH_SIZE,
                    _DEFAULT_MAX_EXPORT_BATCH_SIZE,
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0439636420fe7a92 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:289

                environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f25a09367968c192 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/export/__init__.py:289

                environ.get(
                    OTEL_BSP_EXPORT_TIMEOUT, _DEFAULT_EXPORT_TIMEOUT_MILLIS
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ca8b08113c909c1 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/sampling.py:421

    trace_sampler = os.getenv(
        OTEL_TRACES_SAMPLER, "parentbased_always_on"
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2088e5e6a12259fb — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/sdk/trace/sampling.py:430

            rate = float(os.getenv(OTEL_TRACES_SAMPLER_ARG, ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-search-documents

python dependency

medium pii_flow dependency Excluded from app score #4ae14faf6a35c423 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:70 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:70

    print(f"Retrieved: knowledge source '{knowledge_source.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f215d93218edfe98 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:127 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:127

    print(f"Retrieved: knowledge base '{knowledge_base.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5cbf96edd3a88c18 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:73 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:73

    print(f"Retrieved: knowledge source '{knowledge_source.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e6552ad1aa6ee174 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:134 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:134

    print(f"Retrieved: knowledge base '{knowledge_base.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #ce3e2cfa4bf3762d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication.py:39 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication.py:32 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication.py:39

    print(f"Document count: {document_count} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e18dbdd6683f4f01 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication.py:55 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication.py:48 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication.py:55

    print(f"Indexes ({len(names)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5bef1f23dcd37099 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication_async.py:41 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication_async.py:33 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication_async.py:41

    print(f"Document count: {document_count} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #db565871af3b7d04 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_authentication_async.py:58 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication_async.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_authentication_async.py:58

    print(f"Indexes ({len(names)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #da6dec6b4503c0fe — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:59 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:59

    print(f"Uploaded: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #15866ebfe58f6ac0 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:72 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:72

    print(f"Merged: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d3c8bbcd832e37c8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:87 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:87

    print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cee7c1b23a61778d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:100 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:100

    print(f"Deleted: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f9fc572b98dc40e9 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud.py:115 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud.py:115

    print(f"Merge or upload: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d38c8678f47da432 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:61 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:61

    print(f"Uploaded: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #65f9107173b5e899 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:77 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:77

    print(f"Merged: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #822a844475fade50 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:93 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:93

    print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cca4be167631a194 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:107 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:107

    print(f"Deleted: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #28c7800b606f6435 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:123 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_documents_crud_async.py:123

    print(f"Merge or upload: document 100 (succeeded={result[0].succeeded})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #be10e33a99e61921 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:42 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:42

    print(f"Created: alias '{result.name}' -> index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4bc6bd232ccf8cf0 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:54 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:54

    print(f"Retrieved: alias '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c73c3d313c9a6305 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:108 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud.py:108

    print(f"Updated: alias '{result.name}' -> index '{new_index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #38e1e409c1b5ea60 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:44 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:44

    print(f"Created: alias '{result.name}' -> index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #111c1cfd40f5eb01 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:57 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:57

    print(f"Retrieved: alias '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d6a2266ac9ba74b8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:112 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:112

    print(f"Updated: alias '{result.name}' -> index '{new_index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #428f4e83d796d621 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_analyze_text.py:43 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_analyze_text.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_analyze_text.py:43

        print(f"  Token: {token.token}, Start: {token.start_offset}, End: {token.end_offset}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cd5ded29085e37f2 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:45 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:45

        print(f"  Token: {token.token}, Start: {token.start_offset}, End: {token.end_offset}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3dfbf5807d8474eb — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:46 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:33 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:46

    print(f"Response: {response_body}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b3c1411748effcaa — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:51 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:37 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:51

    print(f"Response: {response_body}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0a0bc29fad61487a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:69 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:69

    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #184d4cf2c3fea55f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:80 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:80

    print(f"Retrieved: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #ba7856095699bd2c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:126 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:126

    print(f"Updated: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #bb119c38e306e661 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud.py:139 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud.py:139

        print(f"  - {name}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6a48fced651f58ef — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:72 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud_async.py:72

    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5455894a53116a6c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:84 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud_async.py:84

    print(f"Retrieved: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e530284eea8df765 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:132 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud_async.py:27 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_crud_async.py:132

    print(f"Updated: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #657a832e0caa969f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:43 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:43

    print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #61a7da0aebb4de58 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:59 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:59

        print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c6ce0bb280833855 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:71 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:71

    print(f"Synonym maps ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #ae889d3b60173563 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:85 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:85

            print(f"  {syn}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #095aa2eafae5f62a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:45 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:45

    print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #a4ed181e1d6600aa — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:62 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:62

        print(f"Created: synonym map '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0fc1c2d77ca72b76 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:75 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:75

    print(f"Synonym maps ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4457998183f93eb2 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:90 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:90

            print(f"  {syn}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7b8423940f31ca48 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:74 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:74

    print(f"Created: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #11780f5f67188d10 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:87 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:87

    print(f"Indexers ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #01291bfc6ba4f8c6 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:99 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:99

    print(f"Retrieved: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d15e536712ae248a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:112 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud.py:112

    print(f"Status: indexer '{indexer_name}' is {status.status}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #293390092145340b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:80 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:80

        print(f"Created: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #35b86c3385043aff — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:94 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:94

    print(f"Indexers ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f0c9a7990b734f4f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:107 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:107

    print(f"Retrieved: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #096779163cacdb4c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:121 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:121

    print(f"Status: indexer '{indexer_name}' is {result.status}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0f52e0c268ee7f5a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:51 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:51

    print(f"Created: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f150f9568b31eadf — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:64 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:64

    print(f"Data sources ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b569e6cce869aee6 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:76 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:76

    print(f"Retrieved: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #005160dab6752027 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:52 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:52

    print(f"Created: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #76ab1a5c1d26bdea — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:66 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:66

    print(f"Data sources ({len(result)}): {', '.join(names)}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3fc5e06514172e27 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:79 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:79

    print(f"Retrieved: data source '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7e8c2db151f56faa — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:119 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:119

    print(f"Retrieved: indexer '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f3916d4cb0c5564d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:130 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:130

        print(f"Scheduled: indexer every {updated_indexer.schedule.interval}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c577eb52e61a8ebb — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:134 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_indexer_workflow.py:134

    print(f"Status: indexer '{updated_indexer.name}' is {status.status}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #1d4979d0c7bcd66f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_autocomplete.py:40 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_autocomplete.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_autocomplete.py:40

        print(f"  Completion: {result['text']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #26b3ea09a81444ed — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:43 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:28 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:43

            print(f"  Completion: {result['text']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8103e81c88d4e90e — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_facets.py:43 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_facets.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_facets.py:43

            print(f"  {facet}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #151007979953e89c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_facets_async.py:46 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_facets_async.py:28 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_facets_async.py:46

                print(f"  {facet}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #167f8ce40ac89ba0 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_filter.py:45 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_filter.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_filter.py:45

        print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7ff6d09bcf476d76 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_filter_async.py:48 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_filter_async.py:28 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_filter_async.py:48

            print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f0622cbc5cd02e72 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:66 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:66

        print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c0d3d1694e6b01a7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:67 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:67

        print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5350fe74e14958e4 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:89 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:89

        print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #25ebdf4ecbd34f7b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic.py:90 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic.py:90

        print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2430aff5e50c9e3c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:69 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:69

            print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #481fcf740c0e469c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:70 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:70

            print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2bafbabf5a475d0c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:91 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:91

            print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #35eefe52b2e6d4a7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:92 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_semantic_async.py:92

            print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2ca691543853423a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_session.py:38 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_session.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_session.py:38

        print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #382ddaf9a69c8d68 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_session_async.py:40 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_session_async.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_session_async.py:40

            print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #863d1c3090d472bc — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_simple.py:38 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_simple.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_simple.py:38

        print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8c1eba417c683215 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_simple_async.py:41 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_simple_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_simple_async.py:41

            print(f"  HotelName: {result['HotelName']} (rating {result['Rating']})")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #01ec96a16dee68f1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_suggestions.py:39 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_suggestions.py:24 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_suggestions.py:39

        print(f"  Text: {result['text']!r}, HotelName: {hotel['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3d482e65fe674fb7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:42 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:42

            print(f"  Text: {result['text']!r}, HotelName: {hotel['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #1ca634047b6f2e1b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:130 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:130

    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4f09295cf90a4619 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:148 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:148

    print(f"Uploaded: {len(result)} documents to index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #38d212941f5f3aca — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:170 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:170

        print(
            f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, " f"Category: {result.get('Category')}"
        )

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2bf8047e4ade2c4f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:196 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:196

        print(f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, " f"Tags: {result.get('Tags')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cf266cf3bc3e4294 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:221 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:221

        print(f"  Score: {score}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6cc562ebc869a615 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:222 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:222

        print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3214191e1c62dfed — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:223 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:223

        print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #416e012a328ec808 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:224 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:224

        print(f"  Description: {result.get('Description')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #977826d8ec795e3c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:225 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:225

        print(f"  Category: {result.get('Category')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #1ef11fcaf7338da5 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector.py:226 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:50 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector.py:226

        print(f"  Tags: {result.get('Tags', 'N/A')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b1eddd6c39363e9c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:134 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:134

    print(f"Created: index '{result.name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5aca466dc56522d2 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:153 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:153

    print(f"Uploaded: {len(result)} documents to index '{index_name}'")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #7813e2fc22c75e70 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:176 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:176

            print(
                f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, "
                f"Category: {result.get('Category')}"
            )

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #03b0bfdbec1c7b7c — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:204 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:204

            print(f"  HotelId: {result['HotelId']}, HotelName: {result['HotelName']}, " f"Tags: {result.get('Tags')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #971890cd3b6b2c9e — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:230 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:230

            print(f"  Score: {score}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8f7523b591b287e4 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:231 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:231

            print(f"  HotelId: {result['HotelId']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cd5f7b103fc9844b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:232 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:232

            print(f"  HotelName: {result['HotelName']}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3e8f88895433acb0 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:233 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:233

            print(f"  Description: {result.get('Description')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3a80c2048d82e204 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:234 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:234

            print(f"  Category: {result.get('Category')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #9a0af06e3e70d3ce — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:235 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:52 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_query_vector_async.py:235

            print(f"  Tags: {result.get('Tags', 'N/A')}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #18408b6f4df1df0d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:42 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:25 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:42

    print(f"Document count: {response_body} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b4a889c3930db5b1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:48 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:26 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:48

    print(f"Document count: {response_body} (index '{index_name}')")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 133 low-confidence finding(s)

low env_fs dependency Excluded from app score #89ef57787ab07680 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:43

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85f33cbdda59664a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:44

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07fbe1007fdeeea3 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agentic_retrieval.py:45

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42a99993fcbc77c1 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:44

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a1e871388ea90b4 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:45

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82efde97cf3c7878 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agentic_retrieval_async.py:46

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5de07dabad36884 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:30

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6cec3c8dd2bf104 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:31

    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4616de5abb395e15 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:32

    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5249914f8a59c372 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:47

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8856dfa8075564f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:48

    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bd9ca7aaaecdcbd — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:63

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bda5e05119ce59af — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:64

    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66a43e4488a32c40 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication.py:80

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75c39ae80abb4f8c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:31

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8c0768ffc790f64 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:32

    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #60e103c310424a92 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:33

    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24461527050f2e93 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:49

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac312e8321521c2f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:50

    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2064ee87c706bed — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:66

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dcca342a112a0b3f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:67

    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97fd73c9a064cf3a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_authentication_async.py:84

    service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9bc441d90efe082 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b79c6d286728d82a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bf638e647a22911 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_buffered_sender.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b234ef45fe23132b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:25

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8914ea77bcc1378a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:26

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38d45e736dc90348 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_buffered_sender_async.py:27

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ae588e2ea65fbe1 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_crud.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #470269c8d8878554 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_crud.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5dd0cff305ec007 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_crud.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dee48dd9a497fcf4 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:25

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db6dda1391145778 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:26

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bc2980e418a71bc — Environment-variable access.

pkgs/python/[email protected]/samples/sample_documents_crud_async.py:27

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5692bf484fe2dd09 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:25

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f5b57131675aaab — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:26

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f86faa2d397c21c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_alias_crud.py:27

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec830a4135c8a24b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:26

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83a55775b987b6d7 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:27

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17c841a4147035fc — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_alias_crud_async.py:28

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd8e21d1730874fa — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_analyze_text.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #edbe6269cd9268f2 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_analyze_text.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c1cd14edc6633d5 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_analyze_text.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88a71968e82d8d88 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:25

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5fe13d812cfcf0c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:26

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbc2755bfaf556d5 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_analyze_text_async.py:27

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82aed0850448df71 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:31

    endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3795af229127fdb — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:32

    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c30af52214e499b0 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_client_custom_request.py:33

    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2be2869f8495c4c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:35

    endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #624d8b9a6398d1f4 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:36

    index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #433455b87dde2bf7 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_client_custom_request_async.py:37

    key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7149fbed496c749b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_crud.py:25

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef3edd6bb76c20c9 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_crud.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6046a0f630db1615 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:26

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b164a1398770fae6 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_crud_async.py:27

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5e720b05d5080bc — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:22

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #935b24d9da47d06e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:23

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #081b980007ec6ea0 — Filesystem access.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud.py:54

    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #197c6393eb5537bb — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:23

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf6f26df50a0d451 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:24

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4118808eebddc84 — Filesystem access.

pkgs/python/[email protected]/samples/sample_index_synonym_map_crud_async.py:56

    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e29846d16eed8435 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b9065a832795695 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:25

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1933659afba88d9 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_crud.py:26

connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0742280752ca80a3 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:25

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c89dcfd1f975fbb — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e43546a0ea16bb4 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_crud_async.py:27

connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f68b0b0a708c8ddd — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe8cf288363e7c51 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:25

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39e947ea65a17cc1 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud.py:26

connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7a11846f9c6e10e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:25

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7af0fdcbc36a9f6 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ea6be2b8891ca0c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_datasource_crud_async.py:27

connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f23de413f1f7db3c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be752590251c0a31 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:25

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1017792e1075740a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_indexer_workflow.py:26

connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdb98825a62f0ed3 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_autocomplete.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91069ac9868287c9 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_autocomplete.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f070078222199202 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_autocomplete.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22bd48823fe1f1b6 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:26

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87018cc904fdebed — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:27

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab4331663fe4248c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_autocomplete_async.py:28

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38a0fb0f895b8dd6 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_facets.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75caccf03a3d8c90 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_facets.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c604c1b5d326de16 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_facets.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9fb02845ca96dc1 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_facets_async.py:26

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dda8a5ee7c1210e6 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_facets_async.py:27

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a189d8717ad3a76e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_facets_async.py:28

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08743b5dd17ee546 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_filter.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c95c1f813490e262 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_filter.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c99915dd2b3956eb — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_filter.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #badcd7b6916fc7a5 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_filter_async.py:26

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b77560e8a2c7c6f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_filter_async.py:27

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfaf6385e6519ad5 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_filter_async.py:28

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0381868bc8a787f8 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_semantic.py:22

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52fc237226e195ff — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_semantic.py:23

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56cdb5bd936b266b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_semantic.py:24

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89d3c942162d4b42 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:23

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c79e427e62bf0e1b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:24

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #508c78e525fee3d7 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_semantic_async.py:25

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2e50fb64388894d — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_session.py:22

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdb3dbbdb615f839 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_session.py:23

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88d6e3beebd529b5 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_session.py:24

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6d4f5f4627b0179 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_session_async.py:23

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc0b76fab048749c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_session_async.py:24

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e62310e969bdd1f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_session_async.py:25

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79884454e42ae705 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_simple.py:22

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2211502db4e055c0 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_simple.py:23

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe141b69ae10666c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_simple.py:24

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc049e1e1934d34f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_simple_async.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3323a8b90c6dc9b7 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_simple_async.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19327b904ff4d2d9 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_simple_async.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #496dc298c17f906e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_suggestions.py:22

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #396358683289a72f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_suggestions.py:23

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #70250710dfdf0891 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_suggestions.py:24

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fe6e57467a3d1e9 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e34b77eb91ee36c2 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9518067041ad9bb — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_suggestions_async.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c92f68d9578fa5b8 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_vector.py:49

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #290f4ff302420107 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_vector.py:50

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6096fcb45e0cdc46 — Filesystem access.

pkgs/python/[email protected]/samples/sample_query_vector.py:60

    with open(query_vector_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1f4781f1e451e6e — Filesystem access.

pkgs/python/[email protected]/samples/sample_query_vector.py:134

    with open(documents_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ecac8d45ff0f8a3 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:51

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #373f0be7d3c05153 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:52

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67fe06014a22c514 — Filesystem access.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:63

    with open(query_vector_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aac92d18498b8440 — Filesystem access.

pkgs/python/[email protected]/samples/sample_query_vector_async.py:138

    with open(documents_path, "r", encoding="utf-8") as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16df969878f1794b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:23

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d97e56b2097a3d27 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:24

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3368a40dafd96a91 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_search_client_custom_request.py:25

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd08f677ca602ed3 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:24

service_endpoint = os.environ["AZURE_SEARCH_SERVICE_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cb1c0088025adb2 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:25

index_name = os.environ["AZURE_SEARCH_INDEX_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c8b8b40f91769ea — Environment-variable access.

pkgs/python/[email protected]/samples/sample_search_client_custom_request_async.py:26

key = os.environ["AZURE_SEARCH_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-cloud-aiplatform

python dependency

medium pii_flow dependency Excluded from app score #a82174325dc74ecc — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:1848 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:1851 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:1848

            httpx_client=httpx.AsyncClient(
                headers={
                    "Authorization": (
                        f"Bearer {self.api_client._api_client._credentials.token}"
                    )
                },
                timeout=(
                    self.api_client._api_client._http_options.timeout / 1000.0
                    if self.api_client._api_client._http_options.timeout
                    else None
                ),
            ),

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium telemetry dependency Excluded from app score #9003e8978255a994 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:2191

        import opentelemetry

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #baafda11969d195f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:2205

        import opentelemetry.sdk.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #16712f21e655bd4a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:2233

        import opentelemetry.exporter.cloud_trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium pii_flow dependency Excluded from app score #34d12a5c532c8251 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1800 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1803 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1800

            httpx_client=httpx.AsyncClient(
                headers={
                    "Authorization": (
                        f"Bearer {initializer.global_config.credentials.token}"
                    )
                }
            ),

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium telemetry dependency Excluded from app score #edb5e678083a5f8e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:106

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #278de54a509d0941 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:284

        import opentelemetry.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ba99b285fa60826f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:285

        import opentelemetry._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #89178d2b429fc2e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:293

        import opentelemetry.sdk.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #115ead35bca19e36 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:294

        import opentelemetry.sdk._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6034352368b70c59 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:371

        import opentelemetry

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cae671b40feb20e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:372

        import opentelemetry.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c58e91888453635c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:373

        import opentelemetry._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6fd591b624eca75c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:380

        import opentelemetry.sdk.resources

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fb7b4df8a1315409 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:381

        import opentelemetry.sdk.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0a6b08b1ca2e3b51 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:382

        import opentelemetry.sdk.trace.export

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dee3ce2ea8a1c504 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:383

        import opentelemetry.sdk._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c905b02a35372e2c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:384

        import opentelemetry.sdk._logs.export

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f11d1e1b89a25c23 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:417

            import opentelemetry.exporter.otlp.proto.http.version

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1736003fa2068a3e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:418

            import opentelemetry.exporter.otlp.proto.http.trace_exporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5d255b7af10980ae — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:494

            import opentelemetry.exporter.cloud_logging

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2f4c209e2126501a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:546

        from opentelemetry.instrumentation import google_genai

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4759b7ad610cf616 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/ag2.py:37

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #96c933d2d66f21e4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/langchain.py:54

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #353f2540be042f3e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/langgraph.py:49

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #25d1a38ce375e294 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/llama_index.py:42

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium pii_flow dependency Excluded from app score #cc64ea8613496e32 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1842 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1845 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1842

            httpx_client=httpx.AsyncClient(
                headers={
                    "Authorization": (
                        f"Bearer {self.api_client._api_client._credentials.token}"
                    )
                },
                timeout=(
                    self.api_client._api_client._http_options.timeout / 1000.0
                    if self.api_client._api_client._http_options.timeout
                    else None
                ),
            ),

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium pii_flow dependency Excluded from app score #13947b24dafdc7f7 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1957 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1960 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1957

            httpx_client=httpx.AsyncClient(
                headers={
                    "Authorization": (
                        f"Bearer {self.api_client._api_client._credentials.token}"
                    )
                },
                timeout=(
                    self.api_client._api_client._http_options.timeout / 1000.0
                    if self.api_client._api_client._http_options.timeout
                    else None
                ),
            ),

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium pii_flow dependency Excluded from app score #9e52aeaef71fa4bd — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1791 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1794 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1791

            httpx_client=httpx.AsyncClient(
                headers={
                    "Authorization": (
                        f"Bearer {initializer.global_config.credentials.token}"
                    )
                }
            ),

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

medium telemetry dependency Excluded from app score #4cc2cd745163ed2d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/_utils.py:712

        import opentelemetry  # noqa:F401

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4a10d325a5806723 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/_utils.py:726

        import opentelemetry.sdk.trace  # noqa:F401

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1ff3269628f53999 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/_utils.py:754

        import opentelemetry.exporter.cloud_trace  # noqa:F401

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d037aa55b7b90763 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:90

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #74d139f9a4a9bda4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:268

        import opentelemetry.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f69c8504b026847a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:269

        import opentelemetry._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #11bffdb98c91fe8b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:277

        import opentelemetry.sdk.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2ab09a9ae554ed05 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:278

        import opentelemetry.sdk._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #87e92eb9d6f586cf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:355

        import opentelemetry

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #05e174732197d0e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:356

        import opentelemetry.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cb529cef53d3e84b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:357

        import opentelemetry._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4081771a65fd8606 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:364

        import opentelemetry.sdk.resources

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bc975a4ad180ede1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:365

        import opentelemetry.sdk.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #23cc423e79b63551 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:366

        import opentelemetry.sdk.trace.export

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d0ea4dc88f1854c1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:367

        import opentelemetry.sdk._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cb2d0bffc948fa71 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:368

        import opentelemetry.sdk._logs.export

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ee8a8293de342275 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:401

            import opentelemetry.exporter.otlp.proto.http.version

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #455619c4fb785270 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:402

            import opentelemetry.exporter.otlp.proto.http.trace_exporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8a37151aa7f6e1e7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:478

            import opentelemetry.exporter.cloud_logging

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2c62d3728790e320 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:530

        from opentelemetry.instrumentation import google_genai

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0d4c0880cc278e44 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/ag2.py:37

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7486c447977b6998 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/langchain.py:54

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #83ce4385aae37502 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/agent_engines/templates/langgraph.py:49

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0348cb6ca1670cc7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:91

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7264b1469d2f8591 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:329

        import opentelemetry.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fc85dbe2148890b2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:330

        import opentelemetry._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #84a6140eb9e27fc6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:338

        import opentelemetry.sdk.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b2bbfd1c25eec010 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:339

        import opentelemetry.sdk._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #eaa33b26c71d6bdd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:416

        import opentelemetry

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #eccd15e9c9dd25b8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:417

        import opentelemetry.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7db7c178c45a90dd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:418

        import opentelemetry._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dc920d49a3b66300 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:425

        import opentelemetry.sdk.resources

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c36149638a2d5ffc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:426

        import opentelemetry.sdk.trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ad2c07aae723b4bf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:427

        import opentelemetry.sdk.trace.export

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0c4e0f45d3a101a3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:428

        import opentelemetry.sdk._logs

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f4a2f98ddcd39838 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:429

        import opentelemetry.sdk._logs.export

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #86f899f1ee841a08 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:462

            import opentelemetry.exporter.otlp.proto.http.version

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6d8dd5ac8331b087 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:463

            import opentelemetry.exporter.otlp.proto.http.trace_exporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #874de6c58534563f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:539

            import opentelemetry.exporter.cloud_logging

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #468044e8d09307e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:591

        from opentelemetry.instrumentation import google_genai

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e4c414e771326119 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/ag2.py:37

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4b7c7404563aa173 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/langchain.py:54

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #62863b85b1441b64 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/langgraph.py:57

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b10900568b78871d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/llama_index.py:42

        from opentelemetry.sdk import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #036a1cb7361716a0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/reasoning_engines/_utils.py:365

        import opentelemetry  # noqa:F401

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #efc36275c06c228e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/reasoning_engines/_utils.py:379

        import opentelemetry.sdk.trace  # noqa:F401

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9cb632554a31b9df — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/vertexai/reasoning_engines/_utils.py:407

        import opentelemetry.exporter.cloud_trace  # noqa:F401

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 779 low-confidence finding(s)

low env_fs dependency Excluded from app score #33efa47aa4928c52 — Filesystem access.

pkgs/python/[email protected]/agentplatform/_genai/_agent_engines_utils.py:1463

            with open(requirements) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #340db7c8c6939d30 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:913

        agent_resp = api_client.request("get", f"agents/{agent_short_id}", {}, None)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #728025d0c132afb9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:957

        response = self._api_client.request("get", f"interactions/{interaction_id}", {})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f40e9aac33722f2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:1068

        interaction = interactions_client.get(interaction_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a4582f693a00bb2c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:1300

            response = api_client.request("get", path, {}, None)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #3d7d050eb83dd344 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:3022

    original_location = os.environ.get("GOOGLE_CLOUD_LOCATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5b62e470fce9176 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:3044

                os.environ["GOOGLE_CLOUD_LOCATION"] = "global"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #106ed2b80cab224b — Environment-variable access.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:3073

                del os.environ["GOOGLE_CLOUD_LOCATION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #614e2037158d0811 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/_genai/_evals_common.py:3075

                os.environ["GOOGLE_CLOUD_LOCATION"] = original_location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #6ce745cce76b2f28 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/_evals_utils.py:923

        response = api_client.request("get", operation.name, {}, None)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ce63d6607ee50f7f — Filesystem access.

pkgs/python/[email protected]/agentplatform/_genai/_skills_utils.py:46

                with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #0224abbebeebd86b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/a2a_task_events.py:162

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bc858f43ebe837e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/a2a_task_events.py:251

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d9852919c4d515d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/a2a_tasks.py:198

        self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1473c05bdf0cf57a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/a2a_tasks.py:256

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #af9e436d21da93f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/a2a_tasks.py:340

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1b2864e6cbef7a5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/a2a_tasks.py:428

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6e24dde5fe12d3a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:814

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c4509653089e19c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:888

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3b34662e17e1d0c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:965

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8e36fba2de73ff6d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1038

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c0f26bd452ae4f09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1130

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #63ab5dd28611c31f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1199

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7cbe90131d53dd8f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1270

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1d15fa4df79619e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1341

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8566027b29a10270 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1413

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1a210b8bcb3ee7b2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1484

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d96376333644df1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/agent_engines.py:1631

        raw_response = self._api_client.request("get", name, {})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #059b18073199fdcf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:298

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ce05ace5f0ed6e75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:390

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2b70eb2f421eb426 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:472

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d9470fa499558677 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:543

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8279daad56ef914a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:615

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #73407c1436572763 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:693

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #78ac869cc210656b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:763

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6f466da70ca31bc0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/datasets.py:843

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c488cf8d15e7b5f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1064

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7116e2fedae0d409 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1140

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bea3cdb6f2c2d9f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1229

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #10ce9d45aef2124d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1306

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2eb89ae2d930c82b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1378

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1b9af673e0f489cc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1482

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #178a6e5636c14481 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1564

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #50642d5162e35019 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1642

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d77896a791a8487b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1722

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #eddddae247aa8ab3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1794

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0eadf9b89d413bc0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1866

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e7513bf79a577c7f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:1938

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8f63a7467ba1ab79 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:2007

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #48c9b118dfaa77ca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:2075

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1fbd93446012eb49 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/evals.py:2353

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c8ad54f32394811a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_contexts.py:155

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e2c87416e53600de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_contexts.py:225

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #72f300fa2aa1235a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_contexts.py:301

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #120aa6e36457f3f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_entries.py:271

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6feb60c06b98f403 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_entries.py:341

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #03339c2bf3f54691 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_entries.py:425

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f37065ac54b07544 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_entries.py:495

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #19a89c98137d8ff0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_entries.py:579

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3196979cf6854932 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_entries.py:649

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cce08cc8db4073aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/feedback_entries.py:719

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #71a9b1b5f30c825f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:619

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aabb9060d606bac2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:701

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5ff899ece15fe3a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:789

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #96f3defba20c6b5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:869

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4905f5cb591d6d54 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:953

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a11ef1d50f538df1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1027

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7d0bbb6b1c816f3d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1097

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3f9b11798f4f3c7e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1167

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #efcd4ca6288c5114 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1251

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d89b607344259a57 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1353

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3e98b8774f041a84 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1429

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e3eebc842fb55d75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1507

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4b70ac8cdc82ae17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memories.py:1589

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9b7786730a26c18a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memory_revisions.py:140

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #75ce20a950534f5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/memory_revisions.py:224

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #115c8b5a226144cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/model_garden.py:207

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cad99dbfb5048de2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/model_garden.py:278

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9be58dd63fba3e0a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/model_garden.py:352

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #02d4e34b96136a43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompt_optimizer.py:251

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bc29bdfbb03a9e5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompt_optimizer.py:323

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #45608dd015beec80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompt_optimizer.py:395

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #900ba269b573db77 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompt_optimizer.py:586

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c22ddb71cca7c2c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:512

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ed303c83c3112b8a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:592

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #843e4460efebb191 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:664

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b1a309de9fbe6269 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:740

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fe9ec48224826682 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:816

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5138479f3b95b996 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:884

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #84e8c81be2551f32 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:962

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #708092f8fefd4b6e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:1027

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d107c2ce6b2c5ccf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:1101

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e827aa575bf143ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:1177

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3a710ff912569d4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:1261

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ea7a21908ab011db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:1333

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #94de024547d4f1af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:1405

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1b4b0dd2800000c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:1480

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #91ee39b2a0b79375 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/prompts.py:2305

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cd9ed52fa3043b1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:1699

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d8f3cf663229cbac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:1771

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c3f04047f3ba297b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:1839

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8d13aebd8c9017c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:1919

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #93bb6359e43d220b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:1997

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dea032086d6758c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2077

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5a0bb1a0fc83e4db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2154

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c713fa21cd40a182 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2229

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3c51c52773db8cd1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2306

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fa38d2941e44967f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2378

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5585bb7bccc63e23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2447

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e8c6bf7876ae2272 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2519

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #edd40d8d42ef7f49 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2604

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3a0cc06133f6dab1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2672

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #87e7d9583bbaf2e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2746

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2fa18f10d75d59e9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2814

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c57d2298659effd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:2886

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #11ef47fadc4dad09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/rag.py:3189

        response = self._api_client.request(
            "post",
            request_path,
            request_dict,
            http_options,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1376704a2d2f495b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/runtime_revisions.py:189

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3fddfaa11dfe4ac7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/runtime_revisions.py:273

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c39bc6768af15832 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/runtime_revisions.py:359

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0e213e27754549d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/runtime_revisions.py:433

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8836775dcdd713a2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/runtime_revisions.py:507

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ba98b7250b08358e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_snapshots.py:206

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d5f0437e688ec59a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_snapshots.py:281

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ae9c578d323970a7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_snapshots.py:356

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e6261e01a14b253d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_snapshots.py:431

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ee92fb5f1e1026c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_snapshots.py:501

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7c9fefa5fd3b3a01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_templates.py:217

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e1eb03b99d6f96c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_templates.py:299

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #19a1cd5e028d0358 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_templates.py:385

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #40bb89ed7b82f4cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_templates.py:467

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c81561d0b944b279 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandbox_templates.py:537

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #50b879f0aa0e178c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandboxes.py:232

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ec7cfd97a611fbdc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandboxes.py:312

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #83b68711567bf5a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandboxes.py:388

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c81febc156a2bb23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandboxes.py:468

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b8ce55f85501c825 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandboxes.py:552

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a37887f2f42b8415 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandboxes.py:622

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7a12f08a6d1b28bc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sandboxes.py:966

        response = http_client._api_client.request(http_method, path, request_dict)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #19e0defde8831c4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/session_events.py:191

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2ad497e7514b7099 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/session_events.py:275

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #773401508625c911 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sessions.py:273

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3ccec6a199065296 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sessions.py:357

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fca553ab801d7416 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sessions.py:441

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e33a5e6a726f0e6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sessions.py:525

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #674c16f0d09d0f4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sessions.py:595

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #191dd1253cd71767 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/sessions.py:679

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #de549f40f83c5031 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skill_revisions.py:126

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c41b314b5f19769e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skill_revisions.py:200

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cfbb0cfbb2c46579 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skills.py:268

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d4f4db8ffac559b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skills.py:337

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4fd3a49c12bc0581 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skills.py:413

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f0c6fec289f86ca7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skills.py:482

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b0965a6ec8a62b2c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skills.py:546

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #04fe671e4c617794 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skills.py:615

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #462a47eae834a3d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/_genai/skills.py:683

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #5ac52d1737172838 — Filesystem access.

pkgs/python/[email protected]/agentplatform/_genai/types/common.py:1956

        with open(file_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7768d392f229435 — Filesystem access.

pkgs/python/[email protected]/agentplatform/_genai/types/common.py:2063

                with open(config_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44da1d9004401a4c — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1133

        if GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0d395fcc33c920d — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1134

            os.environ[GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY] = "unspecified"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f67c4f7e6dc4d906 — Filesystem access.

pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1158

            with open(requirements) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #566dc780a942b6dc — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1372

        if env_var not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd870cadc5209698 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/_agent_engines.py:1375

            aip_types.EnvVar(name=env_var, value=os.environ[env_var])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd5534ea36f6caba — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/a2a.py:320

        os.environ["GOOGLE_GENAI_USE_VERTEXAI"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a87e33743068b0b — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/a2a.py:322

        os.environ["GOOGLE_CLOUD_PROJECT"] = project

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7c73f6914f4a748 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/a2a.py:324

        os.environ["GOOGLE_CLOUD_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2750aad72c1489c2 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/a2a.py:325

        agent_engine_id = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID", "test-agent-engine")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee66e5b57aac01f8 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:362

        location = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f577b7036c96d8ff — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:362

        location = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "") or os.getenv(
            "GOOGLE_CLOUD_LOCATION", ""
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6e7ab15abf5f9a2 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:365

        agent_engine_id = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91b2b3f5443728ca — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:401

            "service.name": os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a1a39c4deaad021 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:404

                os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7901a9a76a61b388 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:405

                or os.getenv("GOOGLE_CLOUD_LOCATION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10bc496567223829 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:517

        if "gen_ai_latest_experimental" in os.getenv(
            "OTEL_SEMCONV_STABILITY_OPT_IN", ""
        ).split(","):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddf374d3311320fc — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:524

                        default_log_name=os.getenv(
                            "GCP_DEFAULT_LOG_NAME", "adk-on-agent-engine"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce53eab73dde7f41 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:535

                        default_log_name=os.getenv(
                            "GCP_DEFAULT_LOG_NAME", "adk-on-agent-engine"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #54b3cbc9a8017527 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:614

    r = session.post(endpoint, data=None)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #47d5d79214a18cf6 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:628

    use_mtls_endpoint_str = os.getenv(
        "GOOGLE_API_USE_MTLS_ENDPOINT", _MtlsEndpoint.AUTO.value
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7e5a10ae3880886 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:666

        use_client_cert_str = os.getenv(
            "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
        ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7736c4cc717b9c6a — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:779

                initializer.global_config.api_key or os.environ.get("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f2b489f70920496 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:949

        os.environ["GOOGLE_GENAI_USE_VERTEXAI"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa1212ba1658d025 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:952

            os.environ["GOOGLE_CLOUD_PROJECT"] = project

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31f45ba7f70ef8a3 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:955

            if "GOOGLE_CLOUD_AGENT_ENGINE_LOCATION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94c3de59b7ab8370 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:956

                os.environ["GOOGLE_CLOUD_AGENT_ENGINE_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e016c6922bb5bb4 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:957

            if "GOOGLE_CLOUD_LOCATION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1b68be3be2924bf — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:958

                os.environ["GOOGLE_CLOUD_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9237d85d62f8f82 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:959

        agent_engine_location = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e508d7fb8895dc13 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:959

        agent_engine_location = os.environ.get(
            "GOOGLE_CLOUD_AGENT_ENGINE_LOCATION",  # the runtime env var (if set)
            location,  # the location set in the AdkApp template
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4f2cee6e7e057ff — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:965

            os.environ["GOOGLE_API_KEY"] = express_mode_api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16d3b966334536ae — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:967

            os.environ.pop("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aca422e61a20dd0f — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:968

            os.environ.pop("GOOGLE_CLOUD_LOCATION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1ec7e970d72d72f — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:969

            os.environ.pop("GOOGLE_CLOUD_PROJECT", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14cee945d6a20224 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:976

            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a76dd91971edb1b — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:978

            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b89abcbb67627e3f — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1024

            if "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2151053655ab53a — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1025

                self._tmpl_attrs["app_name"] = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f062eabc140009b7 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1025

                self._tmpl_attrs["app_name"] = os.environ.get(
                    "GOOGLE_CLOUD_AGENT_ENGINE_ID",
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2eaef083c82ec7ba — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1040

        elif "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9e5ff884bf3e9f5 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1051

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c69dd9553cd8751c — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1063

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99f79a3f4f878fa3 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1072

        elif "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ and is_version_sufficient(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec33290933d49a14 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1085

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08e4736ae576844b — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:1097

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4b7365a2f754c74 — Environment-variable access.

pkgs/python/[email protected]/agentplatform/agent_engines/templates/adk.py:2106

        env_value = os.getenv(
            GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY, "unspecified"
        ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a537fdffca97b97 — Filesystem access.

pkgs/python/[email protected]/agentplatform/preview/rag/rag_data.py:449

        "file": open(path, "rb"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc9630ba6b188760 — Filesystem access.

pkgs/python/[email protected]/agentplatform/rag/rag_data.py:427

        "file": open(path, "rb"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e8f3b96a6706b62 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/docker_utils/run.py:52

    return os.environ.get(_ADC_ENVIRONMENT_VARIABLE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #859a0073b68ad8ba — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/explain/lit.py:219

        if os.environ.get("LIT_PROXY_URL"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5ca45ba0ded6bc7 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/initializer.py:92

            project_number = os.environ.get("GOOGLE_CLOUD_PROJECT") or os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93389975cdf66c0c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/initializer.py:92

            project_number = os.environ.get("GOOGLE_CLOUD_PROJECT") or os.environ.get(
                "CLOUD_ML_PROJECT_ID"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f75e0b7cc8821a67 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/initializer.py:379

        location = os.getenv("GOOGLE_CLOUD_REGION") or os.getenv("CLOUD_ML_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ed2ebad2d13db61 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/initializer.py:429

        vertex_product = os.getenv("VERTEX_PRODUCT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de769d6fa5b96651 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/jobs.py:2147

                with open(autolog_script_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bd2cfc408981a88 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/jobs.py:2157

                    trainer_script = open(script_path, "r").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e73b2520faaf07a — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/metadata/_models.py:60

    with open(path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10b2d6071a63e942 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/metadata/_models.py:156

    with open(model_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e499d135de0f83c — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/metadata/_models.py:340

    with open(example_file, "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #972d605ea6423150 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/metadata/_models.py:895

            with open(destination_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93d2c8068bc597ea — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/metadata/metadata.py:267

        if os.getenv(constants.ENV_EXPERIMENT_KEY):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5950b05d9e2351ad — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/metadata/metadata.py:269

                os.getenv(constants.ENV_EXPERIMENT_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77026ac3982e1c41 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/metadata/metadata.py:280

        env_experiment_run = os.getenv(constants.ENV_EXPERIMENT_RUN_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #55746f97ca2b5a3c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/local_endpoint.py:392

                response = requests.post(url, data=request, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #260a94ba5b4a4e9f — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/local_endpoint.py:396

                with open(request_file) as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #791c23206260ddeb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/local_endpoint.py:397

                    response = requests.post(url, data=data, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b08d75f944cfd153 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/local_endpoint.py:425

            response = requests.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #702a4850fb6fbe56 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:61

        if "HANDLER_MODULE" not in os.environ or "HANDLER_CLASS" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67afcd5ca6c0859f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:66

        handler_module = importlib.import_module(os.environ.get("HANDLER_MODULE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c8b28f59a07b5a4 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:67

        handler_class = getattr(handler_module, os.environ.get("HANDLER_CLASS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5cc81c6ef243748 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:73

        if "PREDICTOR_MODULE" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fc00c128edabfac — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:75

                os.environ.get("PREDICTOR_MODULE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f278a696bf018188 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:78

                predictor_module, os.environ.get("PREDICTOR_CLASS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a09654f8638a1b5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:82

            os.environ.get("AIP_STORAGE_URI"), predictor=predictor_class

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b868bf751b3a5325 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:85

        if "AIP_HTTP_PORT" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #adb276b420737932 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:90

            "AIP_HEALTH_ROUTE" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #209d59ac0ee3213b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:91

            or "AIP_PREDICT_ROUTE" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffba883c8c97d59c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:97

        self.http_port = int(os.environ.get("AIP_HTTP_PORT"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66ea23387285f443 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:98

        self.health_route = os.environ.get("AIP_HEALTH_ROUTE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ae0ae53e4b3771c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:99

        self.predict_route = os.environ.get("AIP_PREDICT_ROUTE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c3127e05dc90b1a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:183

    workers_per_core_str = os.getenv("VERTEX_CPR_WORKERS_PER_CORE", "1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28218e73e18ccc51 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:184

    max_workers_str = os.getenv("VERTEX_CPR_MAX_WORKERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67b74341b9fef6a8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:188

    web_concurrency_str = os.getenv("VERTEX_CPR_WEB_CONCURRENCY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #385a7ee6e4cb213e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:198

    os.environ["WEB_CONCURRENCY"] = web_concurrency_str

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba9e622ae96b3bec — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:200

        f'Set the number of model server workers to {os.environ["WEB_CONCURRENCY"]}.'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0f35bed72d70277 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/model_server.py:209

        port=int(os.environ.get("AIP_HTTP_PORT")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe0000da754873ff — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/sklearn/predictor.py:86

            self._model = pickle.load(open(prediction.MODEL_FILENAME_PKL, "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #307aaf2f808a7b62 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/prediction/xgboost/predictor.py:104

            booster = pickle.load(open(prediction.MODEL_FILENAME_PKL, "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95ff819e9e035427 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:36

    env = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ca6c59bc33c4d54 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:44

training_data_uri = os.environ.get("AIP_TRAINING_DATA_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f92b9c92472707ce — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:47

validation_data_uri = os.environ.get("AIP_VALIDATION_DATA_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cdd42c974050d70 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:50

test_data_uri = os.environ.get("AIP_TEST_DATA_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9061525d9b1ce49 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:53

model_dir = os.environ.get("AIP_MODEL_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf00ec305cb5f02c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:56

checkpoint_dir = os.environ.get("AIP_CHECKPOINT_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28a8360cb40ca638 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:59

tensorboard_log_dir = os.environ.get("AIP_TENSORBOARD_LOG_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cee5dd2a05f195a6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:68

tf_profiler_port = os.environ.get("AIP_TF_PROFILER_PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f6fab5249b08cfb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:71

tensorboard_api_uri = os.environ.get("AIP_TENSORBOARD_API_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1de075c9952aa1c7 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:75

tensorboard_resource_name = os.environ.get("AIP_TENSORBOARD_RESOURCE_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e62c8c161b507889 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:78

cloud_ml_job_id = os.environ.get("CLOUD_ML_JOB_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bc10d7ae7cd6fef — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform/training_utils/environment_variables.py:81

http_handler_port = os.environ.get("AIP_HTTP_HANDLER_PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #657f8019fab30c83 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/utils/yaml_utils.py:117

    with open(file_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #7fd55b1edd461260 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/cloud/aiplatform/utils/yaml_utils.py:144

    response = request.urlopen(req)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #79be486763728845 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/vertex_ray/bigquery_datasink.py:119

                        with open(fp, "rb") as source_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a3fe65301177193 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/vertex_ray/predict/sklearn/register.py:160

        with open(model_path, mode="rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7f720d5f3d7735e — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/vertex_ray/predict/sklearn/register.py:167

                with open(f"{temp_dir}/{model_file_name}", mode="rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8464e84554317207 — Filesystem access.

pkgs/python/[email protected]/google/cloud/aiplatform/vertex_ray/render.py:26

        with open(pathlib.Path(__file__).parent / "templates" / file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d12a59423894fc6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/data_foundry_service/client.py:193

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f134b95b58d4aad — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/data_foundry_service/client.py:369

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df0f78edf91c7e58 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/data_foundry_service/client.py:410

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e9ce5742325b4b1 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/data_foundry_service/client.py:411

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7513856421d967f8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/dataset_service/client.py:210

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3e3ce7b4381de07 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/dataset_service/client.py:530

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47e4c61346263a2d — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/dataset_service/client.py:571

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfa25a0ee1489845 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/dataset_service/client.py:572

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #824f65e8465b63a2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/deployment_resource_pool_service/client.py:211

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78c2dc97fe5ed4c3 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/deployment_resource_pool_service/client.py:477

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #34f9f5328c8422a0 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/deployment_resource_pool_service/client.py:520

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #133efd81edd3cea7 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/deployment_resource_pool_service/client.py:521

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2163fd6b86c04d2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/endpoint_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58925e8ece9be5ee — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/endpoint_service/client.py:507

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db3c1662df6eaa61 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/endpoint_service/client.py:548

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99b4dfea5e0b9dbc — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/endpoint_service/client.py:549

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #177b98cfac1f0d2b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/evaluation_service/client.py:191

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1b575ad47a52a51 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/evaluation_service/client.py:367

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40a3897e779add14 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/evaluation_service/client.py:408

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f5fe79e7ac94827 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/evaluation_service/client.py:409

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33f6ca8764a99124 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_admin_service/client.py:223

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8be5501119213654 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_admin_service/client.py:471

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4a3becd5b355afd — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_admin_service/client.py:514

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #303f57e966ad3719 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_admin_service/client.py:515

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95fc363e0ed786ee — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_service/client.py:198

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6339fa49bf3109b9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_service/client.py:398

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ea6f19db5bffe6a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_service/client.py:439

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2cf734011ddf2e73 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_online_store_service/client.py:440

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10d801b6529fccb4 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_registry_service/client.py:205

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47acebe554f03689 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_registry_service/client.py:429

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2645cdd8eb507390 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_registry_service/client.py:470

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3da4e1f40d0ce5ba — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/feature_registry_service/client.py:471

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #724fcfa3cc0f55a0 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_online_serving_service/client.py:205

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b1f53911eb0e31c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_online_serving_service/client.py:407

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ddd7bbae9f0e5d2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_online_serving_service/client.py:450

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a73761a00606319 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_online_serving_service/client.py:451

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38fda9e54bb20cba — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_service/client.py:208

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #862c046542b57c2e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_service/client.py:456

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #551e3d865f8da9aa — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_service/client.py:497

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f49afc5a3a26b084 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/featurestore_service/client.py:498

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cbf3741266a585b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_cache_service/client.py:200

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c895f58b5628574 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_cache_service/client.py:420

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dde6615f6451fe6a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_cache_service/client.py:461

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c6368ebc0447964 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_cache_service/client.py:462

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7d56973bd3daa18 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_tuning_service/client.py:200

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b03e403fa2caee00 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_tuning_service/client.py:488

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92fb451290cf3973 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_tuning_service/client.py:529

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9a9ef113109d3f0 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/gen_ai_tuning_service/client.py:530

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b153d51c494e2854 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_endpoint_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55d74787ecf0fa9c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_endpoint_service/client.py:444

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a827d8f841778005 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_endpoint_service/client.py:485

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c134c1c52f437859 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_endpoint_service/client.py:486

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30467a576029f1eb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_service/client.py:203

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20d4c8c08d9328e7 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_service/client.py:423

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fc8cd97d96d5d84 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_service/client.py:464

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7e511b19596ead3 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/index_service/client.py:465

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2fff8a5fbd0fcd0 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/job_service/client.py:228

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73523006b162c786 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/job_service/client.py:803

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76465e83dd4e21f2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/job_service/client.py:844

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4aeb35626e180c39 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/job_service/client.py:845

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e50d70767de5c0cb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/llm_utility_service/client.py:194

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a460e6538448d32 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/llm_utility_service/client.py:414

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7595a3fa8a62c08d — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/llm_utility_service/client.py:455

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e19c40e16aaece5f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/llm_utility_service/client.py:456

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e2998bac43e3ea6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/match_service/client.py:192

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35ef67f273653339 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/match_service/client.py:390

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0384ea73fff0cfc — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/match_service/client.py:431

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73a4afece2916ae9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/match_service/client.py:432

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d02b831069eb867 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/metadata_service/client.py:212

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a43d231d45f9e8a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/metadata_service/client.py:506

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25481673f685fe6f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/metadata_service/client.py:547

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed835210e5cd5ff6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/metadata_service/client.py:548

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #710f365a36161ff9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/migration_service/client.py:197

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #275a54a52b4a414d — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/migration_service/client.py:522

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f89c61ba1d66613 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/migration_service/client.py:563

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #374d237790f0fc54 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/migration_service/client.py:564

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a34797987c114b2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_garden_service/client.py:195

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3765f1bba241b01a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_garden_service/client.py:454

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f728a12432e24ddf — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_garden_service/client.py:495

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff46c9a23d8fd53f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_garden_service/client.py:496

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f82404048583e88 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_service/client.py:206

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38b7df1292a481a8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_service/client.py:520

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #541a8c138119ae01 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_service/client.py:561

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c9da0d1e0d4b842 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/model_service/client.py:562

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c779feb88d5ee9e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/notebook_service/client.py:216

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58d52abd5dd841b9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/notebook_service/client.py:543

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f6eca096a63a4a6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/notebook_service/client.py:584

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bed70a33610e3c3f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/notebook_service/client.py:585

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1105d104cdcd5782 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/persistent_resource_service/client.py:209

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae044bacf8ff0a60 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/persistent_resource_service/client.py:470

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #787758901e3e4305 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/persistent_resource_service/client.py:511

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec1f3cc745dbe583 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/persistent_resource_service/client.py:512

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39e83d947c3f984e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/pipeline_service/client.py:211

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ca874e9cea1d0c6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/pipeline_service/client.py:610

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a488747a7b46e45 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/pipeline_service/client.py:651

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0d92f8a5be87a68 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/pipeline_service/client.py:652

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b51781dcd41d8334 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/prediction_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f88f04d16e180483 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/prediction_service/client.py:488

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f1d2e74cc5df7aa — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/prediction_service/client.py:529

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a02ba717ab032240 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/prediction_service/client.py:530

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4745289e34771c6b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_execution_service/client.py:208

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7415dfe01779770 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_execution_service/client.py:408

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d48bef150ce4aaec — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_execution_service/client.py:451

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11bf6db7265afc18 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_execution_service/client.py:452

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #159f601ea14762a2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_service/client.py:201

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa70529c31de2f2a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_service/client.py:445

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2accac1f61a8df46 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_service/client.py:486

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fdc7ba1ed060846 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/reasoning_engine_service/client.py:487

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db9121765064f908 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/schedule_service/client.py:205

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c294efa7918dda2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/schedule_service/client.py:648

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c27b35b8ba9302bb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/schedule_service/client.py:689

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfafb656ad44d0c8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/schedule_service/client.py:690

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a49f156a435af04 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/session_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f890f783729cca4 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/session_service/client.py:450

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2cc6a994a4f9d5db — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/session_service/client.py:491

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #729007dd11a53f1d — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/session_service/client.py:492

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28b9276c0f922b84 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/specialist_pool_service/client.py:205

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80ad84fe87361611 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/specialist_pool_service/client.py:403

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3948cc82392fb240 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/specialist_pool_service/client.py:444

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fcc110d2c21de707 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/specialist_pool_service/client.py:445

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89238143104d3c41 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/tensorboard_service/client.py:213

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9a3058fc819c74e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/tensorboard_service/client.py:491

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62d53e2eb5451370 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/tensorboard_service/client.py:532

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e41346a53ff92e04 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/tensorboard_service/client.py:533

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a2d31a2bece7513 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_data_service/client.py:201

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30579b6890b89230 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_data_service/client.py:509

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96a4ce86f8e437c9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_data_service/client.py:550

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b0c94c4ad98ff60 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_data_service/client.py:551

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fcd26e4c3ed197fe — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_service/client.py:196

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16ed0fb5ef6db29c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_service/client.py:394

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1991e244334cab67 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_service/client.py:435

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb5ea21f714b5b54 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vertex_rag_service/client.py:436

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1194579a82e2a7a5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vizier_service/client.py:200

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fde998039ec35e54 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vizier_service/client.py:444

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46d43884bb3985e3 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vizier_service/client.py:485

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9479d293879036b6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1/services/vizier_service/client.py:486

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68890ff64e3f52b8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/dataset_service/client.py:210

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a83dbd3be4ae1bc — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/dataset_service/client.py:618

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #506279e87baf3909 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/dataset_service/client.py:659

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c82755854e459d16 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/dataset_service/client.py:660

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f1eadd74a0670d5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/deployment_resource_pool_service/client.py:213

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72c58c90dc93df9d — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/deployment_resource_pool_service/client.py:479

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a9b55f221c7e2ba — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/deployment_resource_pool_service/client.py:522

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5d99671d25e6b03 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/deployment_resource_pool_service/client.py:523

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f26f9f42b4519e1 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/endpoint_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddd9a9fcecdd22bb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/endpoint_service/client.py:507

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7137e327e84b048 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/endpoint_service/client.py:548

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc1f3f30caa11404 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/endpoint_service/client.py:549

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b92b1f19ef7f9c91 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/evaluation_service/client.py:194

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73382faa8a202ddc — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/evaluation_service/client.py:392

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba6a773adae65de5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/evaluation_service/client.py:433

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e82615e12328b393 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/evaluation_service/client.py:434

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1cd56f84b4a9aa27 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/example_store_service/client.py:199

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4e0cd01edcc8988 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/example_store_service/client.py:397

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6043cb5b47418dc8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/example_store_service/client.py:438

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ce4010e8f575702 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/example_store_service/client.py:439

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c27b978cd0b2b88 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_execution_service/client.py:194

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #316874c65eb1b670 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_execution_service/client.py:414

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #225d209bad413742 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_execution_service/client.py:455

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7cd7c714de2007b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_execution_service/client.py:456

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #387ddecd1427cd31 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_registry_service/client.py:201

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3afadc49d7347c1 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_registry_service/client.py:445

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c20d2fd207d80b89 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_registry_service/client.py:486

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd7d962ec1b7b871 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/extension_registry_service/client.py:487

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1540ceeecdd02f68 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_admin_service/client.py:223

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2b432989330208f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_admin_service/client.py:471

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #393b2598b7fc0927 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_admin_service/client.py:514

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3d663ef674a1d6f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_admin_service/client.py:515

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b294dd7719d7ae22 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_service/client.py:198

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #150db301c9e0f763 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_service/client.py:398

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #235217aba62953d5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_service/client.py:439

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f52a4c76641fe92 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_online_store_service/client.py:440

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61f0bf611c8a05af — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_registry_service/client.py:214

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f0a50a41cb0952e3 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_registry_service/client.py:488

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #391fb0b3766e994c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_registry_service/client.py:529

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e277853a6605a9eb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/feature_registry_service/client.py:530

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccd9631d1f191b4c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_online_serving_service/client.py:205

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f9b7829616a3288 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_online_serving_service/client.py:407

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ec2fdac766efc80 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_online_serving_service/client.py:450

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eebb902f8045c75a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_online_serving_service/client.py:451

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d09ec20da1897afc — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_service/client.py:210

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d341691fbea34e0e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_service/client.py:458

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b29d0b83b130cc77 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_service/client.py:499

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dd141a4941953ff — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/featurestore_service/client.py:500

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #014da99cb2e822b9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_cache_service/client.py:200

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e30b1a4a85828f3 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_cache_service/client.py:420

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d27acdbcb38536ce — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_cache_service/client.py:461

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93446b62b20169c9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_cache_service/client.py:462

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b195fdb8c0090ec9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_tuning_service/client.py:200

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48f658aeab30ef76 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_tuning_service/client.py:488

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #097b0cdc39c424b3 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_tuning_service/client.py:529

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ec9a9620caba0ad — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/gen_ai_tuning_service/client.py:530

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f665f948fcb1563a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_endpoint_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b0f969138072748 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_endpoint_service/client.py:444

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a397d5e45cfe5dab — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_endpoint_service/client.py:485

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa14d8630b946b54 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_endpoint_service/client.py:486

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a22ab03ba19c4fb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_service/client.py:203

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a54e54c17ff72b4 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_service/client.py:423

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5856b7fe37d85911 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_service/client.py:464

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3d8f5d5068575aa — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/index_service/client.py:465

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f6fd34bd83bd649 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/job_service/client.py:230

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a12a1fcf7a534e8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/job_service/client.py:805

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33fbe3d3f03f43ef — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/job_service/client.py:846

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88781c51fd1d3e7c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/job_service/client.py:847

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fcd4ec4cb9256cf — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/llm_utility_service/client.py:192

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a24358c4ff9e7a9 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/llm_utility_service/client.py:390

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c344278ed23ec1a6 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/llm_utility_service/client.py:431

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a27943cf600406d0 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/llm_utility_service/client.py:432

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ccc673209c9ce92 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/match_service/client.py:192

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a8b16c81f45c7df — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/match_service/client.py:390

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba5f07e4789cc39f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/match_service/client.py:431

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fabbdd32022130b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/match_service/client.py:432

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e93b3f3f02dbcb05 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/memory_bank_service/client.py:199

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7de42c31a96a3380 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/memory_bank_service/client.py:445

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fae69206d4d98140 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/memory_bank_service/client.py:486

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa3ee7ec9ffe060a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/memory_bank_service/client.py:487

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f6c12404de2dd03 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/metadata_service/client.py:212

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61b0b621e89ace52 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/metadata_service/client.py:506

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #466b58fad9c4ffc2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/metadata_service/client.py:547

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92321fd4fe32b85f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/metadata_service/client.py:548

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2986311e2eb61924 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/migration_service/client.py:197

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #474120bbfaed73eb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/migration_service/client.py:522

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5d9d3dad9f14764 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/migration_service/client.py:563

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07091b1696e0dbe5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/migration_service/client.py:564

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7dc2465b9e610c2a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_garden_service/client.py:196

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06ea8fea5b200260 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_garden_service/client.py:455

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40081891c967fe73 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_garden_service/client.py:496

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d13daf6bdde21cb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_garden_service/client.py:497

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd0cb484d5805845 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_monitoring_service/client.py:213

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a39b6230a7eb282 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_monitoring_service/client.py:567

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e937e764a2d52687 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_monitoring_service/client.py:608

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b16363060f050a19 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_monitoring_service/client.py:609

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b12c0c20fd73a05a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_service/client.py:208

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6e5e4382da45212 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_service/client.py:522

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8527027d250d3a08 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_service/client.py:563

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6696209b9543b37 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/model_service/client.py:564

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbf914469d11aa8b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/notebook_service/client.py:218

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf71a0fbd4dd6d68 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/notebook_service/client.py:545

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b6f19f2df6eb3a2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/notebook_service/client.py:586

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23be79274f1ae3c8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/notebook_service/client.py:587

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b48e0ed4b68128ef — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/online_evaluator_service/client.py:204

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf26649e7cf7a98b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/online_evaluator_service/client.py:402

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6682f81dbea7a00d — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/online_evaluator_service/client.py:443

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a25cbf676948435 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/online_evaluator_service/client.py:444

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28057e6dd78fb69c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/persistent_resource_service/client.py:209

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72be534d4acc4c4e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/persistent_resource_service/client.py:492

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffb43883b3bed645 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/persistent_resource_service/client.py:533

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd8546e31c1be888 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/persistent_resource_service/client.py:534

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87f1ab1da8bf870c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/pipeline_service/client.py:213

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b684360ffc873952 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/pipeline_service/client.py:612

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54d991a5ea40b70d — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/pipeline_service/client.py:653

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #019c6556b85fe953 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/pipeline_service/client.py:654

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4273952523ebb0f5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/prediction_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45e44fca3233123e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/prediction_service/client.py:488

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea4afc31d6207412 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/prediction_service/client.py:529

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #727ae7d47070add8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/prediction_service/client.py:530

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29694887899b48db — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_execution_service/client.py:208

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e159250a46cfaee — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_execution_service/client.py:408

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a35acf1653a834b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_execution_service/client.py:451

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a986ba568e3c909 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_execution_service/client.py:452

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0896cbc1f95b732a — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_runtime_revision_service/client.py:215

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b270e3b491bc3a5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_runtime_revision_service/client.py:485

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8509a786989862bb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_runtime_revision_service/client.py:528

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f203f59e1419cfb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_runtime_revision_service/client.py:529

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5e66413daf30050 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_service/client.py:203

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8d1f2cff5a706d8 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_service/client.py:493

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e2dd72138d87836 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_service/client.py:534

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff77baf3f25398eb — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/reasoning_engine_service/client.py:535

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8fac3ea679824399 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/schedule_service/client.py:206

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa9b956e0f505f4b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/schedule_service/client.py:761

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5922e8a5efffa5b — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/schedule_service/client.py:802

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ccca872fd1b2f3c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/schedule_service/client.py:803

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7bcc7bbc667d731 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/session_service/client.py:202

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a972a29db951bb19 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/session_service/client.py:450

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32997e3006f7dd3e — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/session_service/client.py:491

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89bc8e531bc2fcb2 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/session_service/client.py:492

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d284f49f4515f92 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/specialist_pool_service/client.py:205

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3055030a859b9ac — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/specialist_pool_service/client.py:403

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3288b0132ca3685 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/specialist_pool_service/client.py:444

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #511c306e88315f56 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/specialist_pool_service/client.py:445

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #341c261d124b2988 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/tensorboard_service/client.py:213

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cf2e7ef4f7ace51 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/tensorboard_service/client.py:491

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c05cffc0fc05bb5 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/tensorboard_service/client.py:532

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c7e76f162e78b3f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/tensorboard_service/client.py:533

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e6091cfdd06ebde — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_data_service/client.py:201

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00aa8d428ad1496f — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_data_service/client.py:559

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #621c284c4c4b08a0 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_data_service/client.py:600

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9745a434f2da1f30 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_data_service/client.py:601

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #adfa631892dc77f3 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_service/client.py:196

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9e50b86d2d19df7 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_service/client.py:394

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c9bc2e0b12ac923 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_service/client.py:435

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36eeb0c365cd3e5c — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vertex_rag_service/client.py:436

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69cfa7718dae30bc — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vizier_service/client.py:200

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b3991b7fa4de1f4 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vizier_service/client.py:444

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b29e4bf706723dda — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vizier_service/client.py:485

        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3596c08febff3a50 — Environment-variable access.

pkgs/python/[email protected]/google/cloud/aiplatform_v1beta1/services/vizier_service/client.py:486

        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52bd0fcf7fdf952f — Filesystem access.

pkgs/python/[email protected]/setup.py:28

with io.open(readme_filename, encoding="utf-8") as readme_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e12c3266ed87ab00 — Filesystem access.

pkgs/python/[email protected]/setup.py:32

with open(os.path.join(package_root, "google/cloud/aiplatform/version.py")) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7071d1b8353720ca — Filesystem access.

pkgs/python/[email protected]/vertexai/_genai/_agent_engines_utils.py:1461

            with open(requirements) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ff4c5172d1d11e0 — Environment-variable access.

pkgs/python/[email protected]/vertexai/_genai/_evals_common.py:2150

    original_location = os.environ.get("GOOGLE_CLOUD_LOCATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a57655f9fd2a1c31 — Environment-variable access.

pkgs/python/[email protected]/vertexai/_genai/_evals_common.py:2172

                os.environ["GOOGLE_CLOUD_LOCATION"] = "global"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1fbb173f9457a8c5 — Environment-variable access.

pkgs/python/[email protected]/vertexai/_genai/_evals_common.py:2201

                del os.environ["GOOGLE_CLOUD_LOCATION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11d8e4f6ca06f204 — Environment-variable access.

pkgs/python/[email protected]/vertexai/_genai/_evals_common.py:2203

                os.environ["GOOGLE_CLOUD_LOCATION"] = original_location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #7dcbcc58205e400f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/_evals_utils.py:923

        response = api_client.request("get", operation.name, {}, None)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #c7ebc69466802492 — Filesystem access.

pkgs/python/[email protected]/vertexai/_genai/_skills_utils.py:50

                with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #6ccf1db939730d7b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/a2a_task_events.py:161

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #60e454ab2e3a63c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/a2a_task_events.py:250

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #574a513e47813e3d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/a2a_tasks.py:198

        self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #013cebceb34708ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/a2a_tasks.py:256

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #90d62fe73442cbbe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/a2a_tasks.py:340

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0583f935b815cd42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/a2a_tasks.py:428

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cc72f742d73b8e6d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:813

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d6f6b922ee5eb361 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:887

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #83bbaddbb1cd2065 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:964

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #08e22aafd0e8ee98 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1037

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a728da0c26fbec28 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1129

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #928a7840c1afde75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1198

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4c5d4d4ce5799686 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1269

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6c5c1e7de5f609b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1340

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #36e2a54efd30dacc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1412

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f7daa7e2b7aff6c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1483

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e5576f48d018282e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/agent_engines.py:1630

        raw_response = self._api_client.request("get", name, {})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3b932e1513826b47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:298

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2daa34b9479ed34e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:390

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c64bae3102969c99 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:472

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c883461f0c4fe10a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:543

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a59f261e15bea463 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:615

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2992d193ea15921b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:693

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #41c5df31aceb5ee7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:763

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #55e0b6a73ffbbcd0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/datasets.py:843

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #576cae21e0aff84d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1057

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #374c0db44e4f4a3e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1133

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3cd4d79705baef2a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1222

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #54f7c1f393a9b088 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1299

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #48abd7fbd9533b6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1371

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0e5e55e6698aebea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1475

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #982d7d2136102c11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1557

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #259452f5c0cba8d9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1635

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0f986717fb811092 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1715

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b2c30be361d72a90 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1787

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6584e2e0e6398962 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1859

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5b06195bcc8ee9d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:1931

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #47a4c10533d78466 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:2000

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1d26a7518677810f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:2068

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8a4ab9e3f210236d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/evals.py:2331

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7a8f147fb96ce70a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:584

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #375c3c0e6fe6103d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:666

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1024fa582f0c9c39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:754

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #21a5dd2db3fcb2c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:834

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6712e5e34978e961 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:918

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #33c707b2e1b40b94 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:992

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1f91159d54d8faae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:1062

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #afc5876d451acd60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:1132

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #54f3740071618b2a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:1216

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #58781e282ca33228 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:1318

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a84e8830de1e5ee0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:1394

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fa70b15d821e4913 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:1472

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #128f844e36d4e8bf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memories.py:1552

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #09aec39bdbe6e787 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memory_revisions.py:140

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a8d1bdc21dd3dc9b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/memory_revisions.py:224

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cb178adb329e3751 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompt_optimizer.py:251

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7c74b4d42977ca15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompt_optimizer.py:323

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #362e2ff21dda2b09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompt_optimizer.py:395

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #eb00731b6b5a1d82 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompt_optimizer.py:586

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c94d3e7e326502ca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:512

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3490c038d35071b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:592

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #40f9956c61f9c6fa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:664

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8b85821b1efbf6a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:740

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cd474991238ff194 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:816

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #254f10ab876d1429 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:884

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #951360f3a51cee1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:962

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e0c8adef2d2f4609 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:1027

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #31cfd1b4ea52109c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:1101

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0173c5e4bedc4f15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:1177

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #984878be48bb1413 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:1261

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c1c1893f881d9ad9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:1333

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a90ae508619bd941 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:1405

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2b0759d388a96422 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:1480

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cc300df1be6de212 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/prompts.py:2311

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #826996e483a3aad8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/runtime_revisions.py:189

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #346df233c51e1514 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/runtime_revisions.py:273

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a30b0f247470bf5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/runtime_revisions.py:359

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #57febe02e630fa01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/runtime_revisions.py:433

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #14cfc0104b26a070 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/runtime_revisions.py:507

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8c893bef51afd648 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_snapshots.py:206

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d8e1046509cd9502 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_snapshots.py:281

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fe794664256ed271 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_snapshots.py:356

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bf94f63493dd1565 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_snapshots.py:431

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5c38baf559c8ceea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_snapshots.py:501

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4c111ceff8ec5bfc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_templates.py:217

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #52c5c4c9a121ca30 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_templates.py:299

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7682da9bca0f1ed5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_templates.py:385

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f319ac7dcb92590d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_templates.py:467

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7153cbc2c6802bf8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandbox_templates.py:537

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5a0589a0afd5fccb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandboxes.py:231

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d21dd0233ce9c03e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandboxes.py:311

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6b0c7e1a07f5c874 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandboxes.py:387

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #05fb1251e6e3a053 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandboxes.py:467

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e10ffeeb041bc2a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandboxes.py:551

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f20df2dc4fd6435f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandboxes.py:621

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3695570e38167f42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sandboxes.py:965

        response = http_client._api_client.request(http_method, path, request_dict)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9c20017c0dd02e8c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/session_events.py:191

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3bf99762fe727b11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/session_events.py:275

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fad613cb649aa434 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sessions.py:273

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #98996ae01d123e50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sessions.py:357

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0cec0fe4899ac94e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sessions.py:441

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4445109accbe02af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sessions.py:525

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9911b51609cd5797 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sessions.py:595

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7c93d7ec205e1bca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/sessions.py:679

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #41c76bf0be94295e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skill_revisions.py:126

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #78133d9a2dd66037 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skill_revisions.py:200

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2f56c84687cafbc6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skills.py:267

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #262ba1c226510cde — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skills.py:336

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a9cb098055420790 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skills.py:410

        response = self._api_client.request("post", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a33627d89b0a8c52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skills.py:479

        response = self._api_client.request("patch", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d047045d77b4cfa3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skills.py:547

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aa5518cf8137a017 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skills.py:616

        response = self._api_client.request("delete", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bb55488bcd44ca72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/_genai/skills.py:684

        response = self._api_client.request("get", path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2c796689c70360ea — Filesystem access.

pkgs/python/[email protected]/vertexai/_genai/types/common.py:1837

        with open(file_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #563782a6f177314c — Filesystem access.

pkgs/python/[email protected]/vertexai/_genai/types/common.py:1944

                with open(config_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d5b8e550edb686f — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1131

        if GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e92cb447a39ec737 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1132

            os.environ[GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY] = "unspecified"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5dd70c71372b025 — Filesystem access.

pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1156

            with open(requirements) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #238b9391ff699029 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1369

        if env_var not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6edcb42da05d44bd — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/_agent_engines.py:1372

            aip_types.EnvVar(name=env_var, value=os.environ[env_var])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf47f264a83320af — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/a2a.py:320

        os.environ["GOOGLE_GENAI_USE_VERTEXAI"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc511ee5992aacc8 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/a2a.py:322

        os.environ["GOOGLE_CLOUD_PROJECT"] = project

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c5042fcd99135a9 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/a2a.py:324

        os.environ["GOOGLE_CLOUD_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6292c30fade4d0ce — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/a2a.py:325

        agent_engine_id = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID", "test-agent-engine")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8bc7809d33db590 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:346

        location = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b7e7cb0b56ace0d — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:346

        location = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "") or os.getenv(
            "GOOGLE_CLOUD_LOCATION", ""
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2c060fa0c7eef28 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:349

        agent_engine_id = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10118984e2ee9258 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:385

            "service.name": os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fcbcfad82525d44 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:388

                os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #49ce4ad837d110c7 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:389

                or os.getenv("GOOGLE_CLOUD_LOCATION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce68d1b37edc01eb — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:501

        if "gen_ai_latest_experimental" in os.getenv(
            "OTEL_SEMCONV_STABILITY_OPT_IN", ""
        ).split(","):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fce4e2c2ff10d42 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:508

                        default_log_name=os.getenv(
                            "GCP_DEFAULT_LOG_NAME", "adk-on-agent-engine"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62342db8eedf3e3b — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:519

                        default_log_name=os.getenv(
                            "GCP_DEFAULT_LOG_NAME", "adk-on-agent-engine"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #5a14a6df75524af8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:598

    r = session.post(endpoint, data=None)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ab73debb53842ace — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:612

    use_mtls_endpoint_str = os.getenv(
        "GOOGLE_API_USE_MTLS_ENDPOINT", _MtlsEndpoint.AUTO.value
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #665e0fd37730b246 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:650

        use_client_cert_str = os.getenv(
            "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
        ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0df67810a6537626 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:756

                initializer.global_config.api_key or os.environ.get("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #118cf6538057e38b — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:920

        os.environ["GOOGLE_GENAI_USE_VERTEXAI"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8cb94b7397d3f798 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:921

        os.environ["GOOGLE_GENAI_USE_ENTERPRISE"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4362a1c8f97934d7 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:924

            os.environ["GOOGLE_CLOUD_PROJECT"] = project

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db5004eba590b381 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:927

            if "GOOGLE_CLOUD_AGENT_ENGINE_LOCATION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a411bebdfed2c758 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:928

                os.environ["GOOGLE_CLOUD_AGENT_ENGINE_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #886270b9ff7bb69d — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:929

            if "GOOGLE_CLOUD_LOCATION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89a745f50a8b69c7 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:930

                os.environ["GOOGLE_CLOUD_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d93d545c5e0b2299 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:931

        agent_engine_location = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db79e3081177332f — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:931

        agent_engine_location = os.environ.get(
            "GOOGLE_CLOUD_AGENT_ENGINE_LOCATION",  # the runtime env var (if set)
            location,  # the location set in the AdkApp template
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2831cd0531aaf7ee — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:937

            os.environ["GOOGLE_API_KEY"] = express_mode_api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #589627a8a03aea01 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:939

            os.environ.pop("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13927ac7ab82abb1 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:940

            os.environ.pop("GOOGLE_CLOUD_LOCATION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e43b03ff121aa21 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:941

            os.environ.pop("GOOGLE_CLOUD_PROJECT", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #503c838c7767d015 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:948

            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c0f24c5006293b6 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:950

            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e728010f2bc59631 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:996

            if "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfd78d878677ed6b — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:997

                self._tmpl_attrs["app_name"] = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b72e174eb70a9c5e — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:997

                self._tmpl_attrs["app_name"] = os.environ.get(
                    "GOOGLE_CLOUD_AGENT_ENGINE_ID",
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #392b4cb4724ccb49 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:1012

        elif "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec54c0033acdd416 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:1023

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b09ebfce92fbfa5f — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:1035

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fba5c46255e7e9c7 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:1044

        elif "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ and is_version_sufficient(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bdc82982b8b0da3f — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:1057

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db80b13a06fc78f6 — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:1069

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6885dde050add30f — Environment-variable access.

pkgs/python/[email protected]/vertexai/agent_engines/templates/adk.py:1802

        env_value = os.getenv(
            GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY, "unspecified"
        ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bf0fed4009fec30 — Filesystem access.

pkgs/python/[email protected]/vertexai/evaluation/utils.py:214

        with open(filepath, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e8730368f288ffc — Filesystem access.

pkgs/python/[email protected]/vertexai/evaluation/utils.py:323

        json.dump(summary, open(local_summary_path, "w"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33b88bc8dbdd398a — Filesystem access.

pkgs/python/[email protected]/vertexai/generative_models/_generative_models.py:3257

        image_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ec1690ba11f8f23 — Filesystem access.

pkgs/python/[email protected]/vertexai/preview/evaluation/metric_utils.py:72

        with open(file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d652d9cb10a47e02 — Filesystem access.

pkgs/python/[email protected]/vertexai/preview/evaluation/metric_utils.py:203

    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c3c1d267f40d2bf — Filesystem access.

pkgs/python/[email protected]/vertexai/preview/evaluation/utils.py:272

        with open(filepath, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f29524562bfcc4ca — Filesystem access.

pkgs/python/[email protected]/vertexai/preview/evaluation/utils.py:408

        json.dump(summary, open(local_summary_path, "w"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef95b34ef4c2875b — Filesystem access.

pkgs/python/[email protected]/vertexai/preview/rag/rag_data.py:490

        "file": open(path, "rb"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe9f033771ca331f — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/a2a.py:241

        os.environ["GOOGLE_GENAI_USE_VERTEXAI"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8fb6784be01afc20 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/a2a.py:243

        os.environ["GOOGLE_CLOUD_PROJECT"] = project

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1046cd3926b9c9c — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/a2a.py:245

        os.environ["GOOGLE_CLOUD_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #790c3bb9f7fabc4e — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/a2a.py:246

        agent_engine_id = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID", "test-agent-engine")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #081c57df13bc9b58 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:278

    use_mtls_endpoint_str = os.getenv(
        "GOOGLE_API_USE_MTLS_ENDPOINT", _MtlsEndpoint.AUTO.value
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2fa7d4f3c4cce74 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:316

        use_client_cert_str = os.getenv(
            "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
        ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ea9c2bb4a8d45a0 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:407

        location = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54f017ad906deda3 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:407

        location = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "") or os.getenv(
            "GOOGLE_CLOUD_LOCATION", ""
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f645b78f8087fe61 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:410

        agent_engine_id = os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e75c0791f45c6e8 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:446

            "service.name": os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_ID", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6c693e1d6e95b56 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:449

                os.getenv("GOOGLE_CLOUD_AGENT_ENGINE_LOCATION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c21fb2b9b4aa801 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:450

                or os.getenv("GOOGLE_CLOUD_LOCATION", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f10237edfbfac05 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:562

        if "gen_ai_latest_experimental" in os.getenv(
            "OTEL_SEMCONV_STABILITY_OPT_IN", ""
        ).split(","):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #547fe661d61b1e9e — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:569

                        default_log_name=os.getenv(
                            "GCP_DEFAULT_LOG_NAME", "adk-on-agent-engine"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #691f3112a19a3fa1 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:580

                        default_log_name=os.getenv(
                            "GCP_DEFAULT_LOG_NAME", "adk-on-agent-engine"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5134d66982ee5729 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:833

        os.environ["GOOGLE_GENAI_USE_VERTEXAI"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b61261b8c5d0c16 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:835

        os.environ["GOOGLE_CLOUD_PROJECT"] = project

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #528f057c35b2fc94 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:838

            if "GOOGLE_CLOUD_AGENT_ENGINE_LOCATION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3aea0cdead75ed16 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:839

                os.environ["GOOGLE_CLOUD_AGENT_ENGINE_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba85007a736fe392 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:840

            if "GOOGLE_CLOUD_LOCATION" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c32c783cb1e514f3 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:841

                os.environ["GOOGLE_CLOUD_LOCATION"] = location

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ffd6165277bc60e — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:847

            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fbe5be54e5ef150 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:849

            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c179429f663a7d7 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:889

            os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c04b999e3c097198 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:890

        if "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1243fe8eb7231684 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:891

            self._tmpl_attrs["app_name"] = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a923d83feee0257 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:891

            self._tmpl_attrs["app_name"] = os.environ.get(
                "GOOGLE_CLOUD_AGENT_ENGINE_ID",
                self._tmpl_attrs.get("app_name"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c1d473038b6f15f — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:905

        elif "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e3da92e594042d9 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:915

                        agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77a9f682e93b3f88 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:930

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f10a5b3cc370ae86 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:939

        elif "GOOGLE_CLOUD_AGENT_ENGINE_ID" in os.environ and is_version_sufficient(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b9269bec120a226 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:950

                    agent_engine_id=os.environ.get("GOOGLE_CLOUD_AGENT_ENGINE_ID"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2691d63f41dc3604 — Environment-variable access.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:1674

        env_value = os.getenv(
            GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY, "unspecified"
        ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #ed3818bde8d3bfe4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/preview/reasoning_engines/templates/adk.py:1730

        r = session.post(endpoint, data=None)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #d0e033a3213fe769 — Filesystem access.

pkgs/python/[email protected]/vertexai/rag/rag_data.py:429

        "file": open(path, "rb"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6e127cd54f84cd5 — Filesystem access.

pkgs/python/[email protected]/vertexai/reasoning_engines/_reasoning_engines.py:603

            with open(requirements) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8ee560bf94b75584 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vertexai/tokenization/_tokenizer_loading.py:57

    resp = requests.get(file_url_path)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #0c5b5a20fa5f096c — Filesystem access.

pkgs/python/[email protected]/vertexai/tokenization/_tokenizer_loading.py:84

    with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26a06b74152723cd — Filesystem access.

pkgs/python/[email protected]/vertexai/tokenization/_tokenizer_loading.py:98

        with open(tmp_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c8dbf0cd3368912 — Filesystem access.

pkgs/python/[email protected]/vertexai/vision_models/_vision_models.py:186

        image_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a13065998defaf76 — Filesystem access.

pkgs/python/[email protected]/vertexai/vision_models/_vision_models.py:531

        video_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

opentelemetry-api

python dependency

medium telemetry dependency Excluded from app score #cf8ae46f8ccc6f10 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/__init__.py:25

from opentelemetry._logs._internal import (
    Logger,
    LoggerProvider,
    LogRecord,
    NoOpLogger,
    NoOpLoggerProvider,
    get_logger,
    get_logger_provider,
    set_logger_provider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c890311e70dce8f8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/__init__.py:35

from opentelemetry._logs.severity import SeverityNumber

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b5527e9c3f939f2a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:35

from opentelemetry._logs.severity import SeverityNumber

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6e901678c8273f92 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:36

from opentelemetry.context import get_current

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #47b089ec40bb6d41 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:37

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f1ddf9d8b91d7ff3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:38

from opentelemetry.environment_variables import _OTEL_PYTHON_LOGGER_PROVIDER

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c2aedd69fb602610 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:39

from opentelemetry.trace import get_current_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ba4dc00db57b6192 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:40

from opentelemetry.trace.span import TraceFlags

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #406a849b7e437d02 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:41

from opentelemetry.util._once import Once

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #27f9f4046cccbea1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:42

from opentelemetry.util._providers import _load_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7845966355af6bd5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:43

from opentelemetry.util.types import AnyValue, _ExtendedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #591cd57ed07cca05 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/attributes/__init__.py:10

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #aaa508eef2049113 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/__init__.py:9

from opentelemetry.context import create_key, get_value, set_value

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4c6ce69738d92aee — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/__init__.py:10

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #10bd45272212fc8b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/__init__.py:11

from opentelemetry.util.re import (
    _BAGGAGE_PROPERTY_FORMAT,
    _KEY_FORMAT,
    _VALUE_FORMAT,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3f0e79380a3069fa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/propagation/__init__.py:9

from opentelemetry.baggage import _is_valid_pair, get_all, set_baggage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #39e616dc0c950b74 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/propagation/__init__.py:10

from opentelemetry.context import get_current

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2580d2b7b37f17e4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/propagation/__init__.py:11

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #291434112dc813c3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/propagation/__init__.py:12

from opentelemetry.propagators import textmap

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #25fa7413d5fa2c22 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/baggage/propagation/__init__.py:13

from opentelemetry.util.re import _DELIMITER_PATTERN

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7455d3c280e45533 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/context/__init__.py:12

from opentelemetry.context.context import Context, _RuntimeContext  # noqa

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bd2f9eb44b4962c3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/context/__init__.py:13

from opentelemetry.context.contextvars_context import ContextVarsRuntimeContext

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #01a922d7a8cce502 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/context/__init__.py:14

from opentelemetry.environment_variables import OTEL_PYTHON_CONTEXT

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #75648f8804161108 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/context/__init__.py:30

    from opentelemetry.util._importlib_metadata import (  # noqa: PLC0415
        entry_points,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #06182b2a312ab655 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/context/contextvars_context.py:8

from opentelemetry.context.context import Context, _RuntimeContext

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a95ad0ff60dde857 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/__init__.py:31

from opentelemetry.metrics._internal import (
    Meter,
    MeterProvider,
    NoOpMeter,
    NoOpMeterProvider,
    get_meter,
    get_meter_provider,
    set_meter_provider,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #79ff7ef67627756f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/__init__.py:40

from opentelemetry.metrics._internal.instrument import (
    Asynchronous,
    CallbackOptions,
    CallbackT,
    Counter,
    Histogram,
    Instrument,
    NoOpCounter,
    NoOpHistogram,
    NoOpObservableCounter,
    NoOpObservableGauge,
    NoOpObservableUpDownCounter,
    NoOpUpDownCounter,
    ObservableCounter,
    ObservableGauge,
    ObservableUpDownCounter,
    Synchronous,
    UpDownCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f68075a57aba545d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/__init__.py:59

from opentelemetry.metrics._internal.instrument import Gauge as _Gauge

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #837d0cfd96d5250c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/__init__.py:60

from opentelemetry.metrics._internal.instrument import NoOpGauge as _NoOpGauge

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #13da8e6b579aaa69 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/__init__.py:61

from opentelemetry.metrics._internal.observation import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e466ee1fa2fef988 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/__init__.py:41

from opentelemetry.environment_variables import OTEL_PYTHON_METER_PROVIDER

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f497946ea4a2839f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/__init__.py:42

from opentelemetry.metrics._internal.instrument import (
    CallbackT,
    Counter,
    Gauge,
    Histogram,
    NoOpCounter,
    NoOpGauge,
    NoOpHistogram,
    NoOpObservableCounter,
    NoOpObservableGauge,
    NoOpObservableUpDownCounter,
    NoOpUpDownCounter,
    ObservableCounter,
    ObservableGauge,
    ObservableUpDownCounter,
    UpDownCounter,
    _MetricsHistogramAdvisory,
    _ProxyCounter,
    _ProxyGauge,
    _ProxyHistogram,
    _ProxyObservableCounter,
    _ProxyObservableGauge,
    _ProxyObservableUpDownCounter,
    _ProxyUpDownCounter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8c9929a985daf164 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/__init__.py:67

from opentelemetry.util._once import Once

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0f437dd01fa50ce2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/__init__.py:68

from opentelemetry.util._providers import _load_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4186ece3b3d0e0bf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/__init__.py:69

from opentelemetry.util.types import (
    Attributes,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e8ec4e1bc14fb8df — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/instrument.py:18

from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d370855b176d97a4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/instrument.py:19

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c9ee673239c7b035 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/instrument.py:20

from opentelemetry.metrics._internal.observation import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d9516aee40f13965 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/instrument.py:21

from opentelemetry.util.types import (
    Attributes,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8e818cf8c863ec54 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/observation.py:5

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #33815811686da3e0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/observation.py:6

from opentelemetry.util.types import Attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a1ec5dd258fb4648 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:63

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bb9133b6c88e05e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:64

from opentelemetry.environment_variables import OTEL_PROPAGATORS

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c46aa68b2b7ca70d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:65

from opentelemetry.propagators import composite, textmap

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6204824db5fc5687 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:115

        from opentelemetry.baggage.propagation import (  # noqa: PLC0415
            W3CBaggagePropagator,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #73dcdaba0a9c5766 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:120

        from opentelemetry.trace.propagation.tracecontext import (  # noqa: PLC0415
            TraceContextTextMapPropagator,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #26185c2d7e2cc5fd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:129

    from opentelemetry.util._importlib_metadata import (  # noqa: PLC0415
        entry_points,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d085af1f24a6b03b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagators/_envcarrier.py:15

from opentelemetry.propagators.textmap import Getter, Setter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d6ae73dab727d69a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagators/composite.py:8

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #eeef90d97dec68b0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagators/composite.py:9

from opentelemetry.propagators import textmap

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #728e0094325830c3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/propagators/textmap.py:8

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1980a4216854bbff — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:74

from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #693582d6b06ec17f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:75

from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6e42fff464a92773 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:76

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9279ff0c44155e3f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:77

from opentelemetry.environment_variables import OTEL_PYTHON_TRACER_PROVIDER

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3400f28d92c50fa9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:78

from opentelemetry.trace.propagation import (
    _SPAN_KEY,
    get_current_span,
    set_span_in_context,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #74fa1840eef053e0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:83

from opentelemetry.trace.span import (
    DEFAULT_TRACE_OPTIONS,
    DEFAULT_TRACE_STATE,
    INVALID_SPAN,
    INVALID_SPAN_CONTEXT,
    INVALID_SPAN_ID,
    INVALID_TRACE_ID,
    NonRecordingSpan,
    Span,
    SpanContext,
    TraceFlags,
    TraceState,
    format_span_id,
    format_trace_id,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #11332c8b1f0ef24e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:98

from opentelemetry.trace.status import Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #53d0de1455d0ac1e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:99

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f52e869feb5f2e01 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:100

from opentelemetry.util._decorator import _agnosticcontextmanager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #39c9839ee42462bc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:101

from opentelemetry.util._once import Once

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bf3027988de59ed7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:102

from opentelemetry.util._providers import _load_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #091f952174301f40 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/__init__.py:4

from opentelemetry.context import create_key, get_value, set_value

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5e7659609cd8f7a0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/__init__.py:5

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #69d99b10b36a4117 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/__init__.py:6

from opentelemetry.trace.span import INVALID_SPAN, Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #939267c9dab7b25d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/tracecontext.py:6

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7c00ea8d32828465 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/tracecontext.py:7

from opentelemetry.context.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e15ad73686224383 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/tracecontext.py:8

from opentelemetry.propagators import textmap

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a5969663f27f90f8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/tracecontext.py:9

from opentelemetry.trace import format_span_id, format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0d161c754c49e60c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/propagation/tracecontext.py:10

from opentelemetry.trace.span import TraceState

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7b0012b3192a8853 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/span.py:14

from opentelemetry.trace.status import Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #82a7ebb57378e612 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/trace/span.py:15

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ed45dd35b42ca55f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/util/_providers.py:9

    from opentelemetry.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #48e6e202fa0b3cfb — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/util/_providers.py:10

    from opentelemetry.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2a5741e39bddcd60 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/opentelemetry/util/_providers.py:21

    from opentelemetry.util._importlib_metadata import (  # noqa: PLC0415
        entry_points,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 7 low-confidence finding(s)

low env_fs dependency Excluded from app score #8424a9153fa205d1 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/_logs/_internal/__init__.py:394

        if _OTEL_PYTHON_LOGGER_PROVIDER not in environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f2f07cd9bd3ba1d — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/context/__init__.py:25

    configured_context = os.environ.get(OTEL_PYTHON_CONTEXT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65e91bb685c57b86 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/metrics/_internal/__init__.py:868

        if OTEL_PYTHON_METER_PROVIDER not in environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #905c7a773f97f6ab — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:112

    configured = environ.get(OTEL_PROPAGATORS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43a9e92e44c87ba4 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/propagate/__init__.py:167

environ_propagators = environ.get(OTEL_PROPAGATORS, "tracecontext,baggage")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62a304c75038bf1e — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/trace/__init__.py:573

        if OTEL_PYTHON_TRACER_PROVIDER not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #006eb21eeff18e77 — Environment-variable access.

pkgs/python/[email protected]/src/opentelemetry/util/_providers.py:28

            environ.get(provider_environment_variable, f"default_{provider}"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-core-tracing-opentelemetry

python dependency

medium telemetry dependency Excluded from app score #d45ba56eab60dd3c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/core/tracing/ext/opentelemetry_span/__init__.py:9

from opentelemetry import context, trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ce71569b8af301e1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/core/tracing/ext/opentelemetry_span/__init__.py:10

from opentelemetry.trace import (
    Span,
    Status,
    StatusCode,
    Tracer,
    NonRecordingSpan,
    SpanKind as OpenTelemetrySpanKind,
    Link as OpenTelemetryLink,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #83c7e4e60b78669d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/core/tracing/ext/opentelemetry_span/__init__.py:19

from opentelemetry.propagate import extract, inject  # type: ignore[attr-defined]

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #98aad893adfee26b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/core/tracing/ext/opentelemetry_span/__init__.py:20

from opentelemetry.trace.propagation import get_current_span as get_span_from_context  # type: ignore[attr-defined]

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ce2bd8069496d859 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/core/tracing/ext/opentelemetry_span/__init__.py:24

    from opentelemetry.context import _SUPPRESS_HTTP_INSTRUMENTATION_KEY  # type: ignore[attr-defined]

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #10852cb2721c2817 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_custom_span_processor.py:31

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #245c1799642a2aad — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_custom_span_processor.py:32

from opentelemetry.sdk.trace import ReadableSpan, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #233831fd01d0dd9f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_custom_span_processor.py:33

from opentelemetry.sdk.trace.export import BatchSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c1e08a81cd4b63bd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventgrid.py:29

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e7b58fc37bada6e5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventgrid.py:30

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ae8cd572d1345125 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventgrid.py:31

from opentelemetry.sdk.trace.export import ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #33eba39c7763d545 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventgrid.py:32

from opentelemetry.sdk.trace.export import SimpleSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3467686766364e58 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventhubs.py:27

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #67ea17c0962a214f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventhubs.py:28

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d41fe071be8918e6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventhubs.py:29

from opentelemetry.sdk.trace.export import ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #df88472b54061cae — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_eventhubs.py:30

from opentelemetry.sdk.trace.export import SimpleSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9fc66532b26ffa89 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_eh.py:28

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d1021defef48e586 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_eh.py:29

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bfc985abcb5d1612 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_eh.py:30

from opentelemetry.sdk.trace.export import ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #aca7b753e117db46 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_eh.py:31

from opentelemetry.sdk.trace.export import SimpleSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #27e56846bee2af0f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_sb.py:30

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #831422f5f4a6b419 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_sb.py:31

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #037840a2057798a1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_sb.py:37

from opentelemetry.sdk.trace.export import ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3db098042fbde627 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_receive_sb.py:38

from opentelemetry.sdk.trace.export import SimpleSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a1c0d5b802f229e5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_servicebus.py:28

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #67de2807fa5f1580 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_servicebus.py:29

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fdad2c0d958c730c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_servicebus.py:30

from opentelemetry.sdk.trace.export import ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7bf2969ac07f1c04 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_servicebus.py:31

from opentelemetry.sdk.trace.export import SimpleSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #841d0cdc605a7533 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_storage.py:28

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #de214ee569e39bbe — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_storage.py:29

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #88df9d8baec24c38 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_storage.py:30

from opentelemetry.sdk.trace.export import ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #64de2d23eef77057 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_storage.py:31

from opentelemetry.sdk.trace.export import SimpleSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 15 low-confidence finding(s)

low env_fs dependency Excluded from app score #c31074297c576e63 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_custom_span_processor.py:83

connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93ba5851df4a2b40 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_eventgrid.py:48

hostname = os.environ["CLOUD_TOPIC_HOSTNAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8d48b73d4819685 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_eventgrid.py:49

key = AzureKeyCredential(os.environ["CLOUD_ACCESS_KEY"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #507a42bd27f8a21c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_eventhubs.py:43

FULLY_QUALIFIED_NAMESPACE = os.environ["EVENT_HUB_HOSTNAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e908b701a1be0a0d — Environment-variable access.

pkgs/python/[email protected]/samples/sample_eventhubs.py:44

EVENTHUB_NAME = os.environ["EVENT_HUB_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29364c42c70f1432 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_eventhubs.py:46

credential = os.environ["EVENTHUB_CONN_STR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7322a161eb92f90e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_receive_eh.py:44

FULLY_QUALIFIED_NAMESPACE = os.environ["EVENT_HUB_HOSTNAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #474aa3e0c6b6fa21 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_receive_eh.py:45

EVENTHUB_NAME = os.environ["EVENT_HUB_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03aa070f7853a132 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_receive_eh.py:47

credential = os.environ["EVENTHUB_CONN_STR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02b8d21086626227 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_receive_sb.py:49

connstr = os.environ["SERVICE_BUS_CONN_STR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e09cca708936788 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_receive_sb.py:50

queue_name = os.environ["SERVICE_BUS_QUEUE_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #704b35e9bc4b3cab — Environment-variable access.

pkgs/python/[email protected]/samples/sample_servicebus.py:46

connstr = os.environ["SERVICE_BUS_CONN_STR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #391381f967e83fdb — Environment-variable access.

pkgs/python/[email protected]/samples/sample_servicebus.py:47

queue_name = os.environ["SERVICE_BUS_QUEUE_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00e1a3304905cbe1 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_storage.py:45

connection_string = os.environ["AZURE_STORAGE_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f74cd1e3a4c291a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_storage.py:46

container_name = os.environ["AZURE_STORAGE_BLOB_CONTAINER_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-ai-agents

python dependency

medium telemetry dependency Excluded from app score #59ea4e74f0d16bcc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/ai/agents/telemetry/_ai_agents_instrumentor.py:81

    from opentelemetry.trace import Span, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d1e78bf7be723fe1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/ai/agents/telemetry/_instrument_paged_wrappers.py:8

from opentelemetry.trace import Span, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c0e169639756419a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/ai/agents/telemetry/_trace_function.py:11

    from opentelemetry import trace as opentelemetry_trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5c391ee92cdabb98 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/ai/agents/telemetry/_utils.py:14

    from opentelemetry.trace import StatusCode, Span  # noqa: F401 # pylint: disable=unused-import

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2027acc999b0493a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_multiagent/utils/agent_team.py:9

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #09ea885fdb8541fc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_multiagent/utils/agent_team.py:10

from opentelemetry.trace import Span  # noqa: F401 # pylint: disable=unused-import

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #19740e25e5c6aa3c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_multiagent/utils/agent_trace_configurator.py:8

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e31bef2da8750ec3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_multiagent/utils/agent_trace_configurator.py:9

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f666e066bcb038b6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_multiagent/utils/agent_trace_configurator.py:10

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7bfbd4e6dc50fd97 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_multiagent/utils/user_functions_with_traces.py:10

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #90db56c48e8af370 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_azure_monitor_tracing.py:36

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #306eb661727bc276 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_console_tracing.py:36

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0001911870fd8e5f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_console_tracing.py:37

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f1d1f497538ff2df — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_console_tracing.py:38

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cb5ae4872e06fa30 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_console_tracing.py:42

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #18b8ca469f6f32bf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_azure_monitor_tracing.py:43

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #abdbd9890dd32232 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing.py:38

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #78b49a7145d1c8f3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing.py:39

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #197c35d028fc3b72 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing.py:40

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9ac7642163269b9b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing_custom_attributes.py:40

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cf2e49768b167d59 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing_custom_attributes.py:41

from opentelemetry.sdk.trace import TracerProvider, SpanProcessor, ReadableSpan, Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #81ebbb18f5129dde — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing_custom_attributes.py:42

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b215453fb538e52e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_azure_monitor_tracing.py:44

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f82c7b5a709f6978 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_console_tracing.py:37

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b6174e8894e785ae — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_console_tracing.py:38

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d6c6c09e2cd1d632 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_console_tracing.py:39

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2b762a86e3653471 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_azure_monitor_tracing.py:41

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #880fdb574252205e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_console_tracing.py:39

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #172ac93ddd57591c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_console_tracing.py:40

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #daa58244020ce23d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_console_tracing.py:41

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 184 low-confidence finding(s)

low env_fs dependency Excluded from app score #a004ec5fbec3086b — Environment-variable access.

pkgs/python/[email protected]/azure/ai/agents/_patch.py:62

        if os.environ.get("AZURE_AI_AGENTS_TESTS_IS_TEST_RUN") == "True" and len(parts) == 4:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd6900841e844a27 — Environment-variable access.

pkgs/python/[email protected]/azure/ai/agents/aio/_patch.py:63

        if os.environ.get("AZURE_AI_AGENTS_TESTS_IS_TEST_RUN") == "True" and len(parts) == 4:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6851d2cd9e7492ec — Filesystem access.

pkgs/python/[email protected]/azure/ai/agents/aio/operations/_patch.py:1428

                with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97a5cc11fdd946a2 — Filesystem access.

pkgs/python/[email protected]/azure/ai/agents/aio/operations/_patch.py:1640

                with open(target_file_path, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39a3a567442ed445 — Filesystem access.

pkgs/python/[email protected]/azure/ai/agents/operations/_patch.py:1438

                with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1be6496059e228b6 — Environment-variable access.

pkgs/python/[email protected]/azure/ai/agents/telemetry/_ai_agents_instrumentor.py:200

            var_value = os.environ.get("AZURE_TRACING_GEN_AI_CONTENT_RECORDING_ENABLED")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20fdbf61e8577820 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_auto_function_call_async.py:38

        endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b77ee2fe90dcb9be — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_auto_function_call_async.py:65

            model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e10df694e18fc95 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_azure_functions_async.py:47

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31880c9e263123aa — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_azure_functions_async.py:51

            storage_service_endpoint = os.environ["STORAGE_SERVICE_ENDPONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ded9f2d2bed8b94 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_azure_functions_async.py:73

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d52a5b5365cc12ac — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_basics_async.py:38

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dd1a3a933646d7f — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_basics_async.py:44

                model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83687962c4f15e59 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_basics_create_thread_and_process_run_async.py:42

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae5f47e010a2c8f1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_basics_create_thread_and_process_run_async.py:48

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ca4698e18e85a17 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_basics_create_thread_and_run_async.py:40

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b3a172e284a61eb — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_basics_create_thread_and_run_async.py:46

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41c5dd2869c910d1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_code_interpreter_async.py:43

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=creds) as agents_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7735caae5b30fdfa — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_code_interpreter_async.py:51

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eefd2ae1c20d9dc0 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_code_interpreter_attachment_async.py:42

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=creds) as agents_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc28ffed6ca93811 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_code_interpreter_attachment_async.py:51

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8055463c5247ccbb — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_code_interpreter_attachment_enterprise_search_async.py:40

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=credential) as agents_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b6ed2023a54f83f — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_code_interpreter_attachment_enterprise_search_async.py:46

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #358d12ae21665b90 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_code_interpreter_attachment_enterprise_search_async.py:57

            asset_uri = os.environ["AZURE_BLOB_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da188b4858e19b7c — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_functions_async.py:45

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=creds) as agents_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29d1baec2edb24ed — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_functions_async.py:53

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00e613ec23f39631 — Filesystem access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_image_input_base64_async.py:54

        with open(image_path, "rb") as image_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38f8a7dd04de3e02 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_image_input_base64_async.py:63

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=creds) as agents_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86c6f795576524f8 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_image_input_base64_async.py:66

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e163c9092d6a3a57 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_image_input_file_async.py:44

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=creds) as agents_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da5f3514176214fe — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_image_input_file_async.py:47

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5024a450bd5059b — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_image_input_url_async.py:42

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=creds) as agents_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67464655a5ec4092 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_image_input_url_async.py:45

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f9d4e7b87dcc05f — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_json_schema_async.py:56

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #638215d8df7d5bec — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_json_schema_async.py:61

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e232953666ae1de0 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_run_with_toolset_async.py:35

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e21454055e9419e — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_run_with_toolset_async.py:48

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1dcaee57f3657463 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_eventhandler_async.py:69

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e683d7a5434caa03 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_eventhandler_async.py:73

                model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef2ccbec6eebb7c0 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_eventhandler_with_functions_async.py:97

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e45bf1f2ca176ac — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_eventhandler_with_functions_async.py:102

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82cb7bbbf42f9c8d — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_eventhandler_with_toolset_async.py:73

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63dc54296903a3a7 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_eventhandler_with_toolset_async.py:84

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d40112e5865b5570 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_iteration_async.py:43

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61e5c6268b1689cd — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_iteration_async.py:47

                model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6cea8da233bed79 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_with_base_override_eventhandler_async.py:82

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3faa8b3cebd5ec6 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_stream_with_base_override_eventhandler_async.py:86

                model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f91a5fa054041c0 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_batch_enterprise_file_search_async.py:41

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4c3d201a0852da7 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_batch_enterprise_file_search_async.py:45

            asset_uri = os.environ["AZURE_BLOB_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c954d1a37285e26 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_batch_enterprise_file_search_async.py:64

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd74f5ed32787fdd — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_batch_file_search_async.py:37

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #139d02304df75c7a — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_batch_file_search_async.py:59

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ec311c76e3907ef — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_enterprise_file_search_async.py:39

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77a8437d7e5b5bcd — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_enterprise_file_search_async.py:43

            asset_uri = os.environ["AZURE_BLOB_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98921412bf745a7e — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_enterprise_file_search_async.py:55

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #145d46ba389cdcb0 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_file_search_async.py:35

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #815463c81a421ab5 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_vector_store_file_search_async.py:53

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1003ae0867605157 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_with_file_search_attachment_async.py:39

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02a983450efae5b7 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_async/sample_agents_with_file_search_attachment_async.py:47

                model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86f9853be5305a04 — Filesystem access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_image_input_base64.py:53

        with open(image_path, "rb") as image_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c71bb1e329bb5d05 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_image_input_base64.py:61

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e55d22d7fa1aaf1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_image_input_base64.py:68

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d4cc07b7d964c06 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_image_input_file.py:42

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ddf30e87833ebb1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_image_input_file.py:49

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #101000ca213129a5 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_image_input_url.py:40

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a0d9ae57820f7bb — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_image_input_url.py:47

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5130232bb3b66159 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_json_schema.py:40

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb61ca43d7df8e36 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_json_schema.py:61

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db20399e4e47ffa7 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_vector_store_batch_enterprise_file_search.py:29

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e18312477e0b330 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_vector_store_batch_enterprise_file_search.py:36

    asset_uri = os.environ["AZURE_BLOB_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1fef25baf8362793 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_vector_store_batch_enterprise_file_search.py:56

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56fd4de7090a5b10 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_vector_store_batch_file_search.py:33

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8296fde2b9a54fa1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_vector_store_batch_file_search.py:59

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #994b4d6c3ffa8665 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_vector_store_file_search.py:31

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e7862ff4551a4b9 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_vector_store_file_search.py:50

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2aca0a99d7a216cf — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_with_code_interpreter_file_attachment.py:39

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1ce24b0806aa13a — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_with_code_interpreter_file_attachment.py:53

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd6476f3f06232d1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_with_file_search_attachment.py:33

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a9c59ebccc00bab — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_with_file_search_attachment.py:45

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8859b0013982265 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_with_resources_in_thread.py:33

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac6929f82a790ec3 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_files_images_inputs/sample_agents_with_resources_in_thread.py:51

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb518d7611e5c449 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_multiagent/sample_agents_agent_team.py:43

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc75ed60eeaea41c — Environment-variable access.

pkgs/python/[email protected]/samples/agents_multiagent/sample_agents_agent_team.py:49

model_deployment_name = os.getenv("MODEL_DEPLOYMENT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1be94194a2833931 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_multiagent/sample_agents_agent_team_custom_team_leader.py:33

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65c3564e3f09ce06 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_multiagent/sample_agents_agent_team_custom_team_leader.py:37

model_deployment_name = os.getenv("MODEL_DEPLOYMENT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0053106c5a8d316 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_multiagent/sample_agents_multi_agent_team.py:56

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec8b28abace19651 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_multiagent/sample_agents_multi_agent_team.py:76

model_deployment_name = os.getenv("MODEL_DEPLOYMENT_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2f8ecfd5b0c8e46 — Filesystem access.

pkgs/python/[email protected]/samples/agents_multiagent/utils/agent_team.py:95

        with open(file_path, "r") as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #904940e3fd5f3b07 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_multiagent/utils/agent_trace_configurator.py:20

        application_insights_connection_string = os.environ.get("APPLICATIONINSIGHTS_CONNECTION_STRING")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #331785082c4f8c2d — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_eventhandler_with_bing_grounding.py:83

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #214328164472ad2f — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_eventhandler_with_bing_grounding.py:89

    bing_connection_id = os.environ["AZURE_BING_CONNECTION_ID"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1fb684ef4e974c6b — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_eventhandler_with_bing_grounding.py:96

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b949a52bf55649f2 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_eventhandler_with_functions.py:50

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0714edcc0f9a458f — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_eventhandler_with_functions.py:117

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #049f778c7c36f9cc — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_eventhandler_with_toolset.py:48

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7959c07377e0d8dc — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_eventhandler_with_toolset.py:90

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fa63b8b097b4ddf — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_iteration_with_bing_grounding.py:44

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac3f83e98ae68dac — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_iteration_with_bing_grounding.py:49

    bing_connection_id = os.environ["AZURE_BING_CONNECTION_ID"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddf41c85e0be2577 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_iteration_with_bing_grounding.py:54

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #831c8e65a7c84de5 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_iteration_with_file_search.py:35

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e178504c36f062a — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_iteration_with_file_search.py:52

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #659da1d5582043fb — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_iteration_with_toolset.py:45

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64afea15b29f2515 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_iteration_with_toolset.py:56

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #facd35f570d34363 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_with_base_override_eventhandler.py:78

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc965e07718571b2 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_streaming/sample_agents_stream_with_base_override_eventhandler.py:84

        model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5ece4e610c45684 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_azure_monitor_tracing.py:48

            endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #524875ace4788bb7 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_azure_monitor_tracing.py:53

        application_insights_connection_string = os.environ["APPLICATIONINSIGHTS_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eea9dc27fe26b1d0 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_azure_monitor_tracing.py:59

                    model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16149edfc4e1cfa7 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_console_tracing.py:64

        async with AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=creds) as agent_client:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1eac42e4378299fe — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_async_with_console_tracing.py:67

                model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ca6355095ed3c9b — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_azure_monitor_tracing.py:38

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06712150d1ea545f — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_azure_monitor_tracing.py:47

application_insights_connection_string = os.environ["APPLICATIONINSIGHTS_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84f352239adec662 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_azure_monitor_tracing.py:57

            model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dc95762ff2c6994 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing.py:57

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2af3bd57dc0e3870 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing.py:65

            model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b03268e454711876 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing_custom_attributes.py:79

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d7433150cdd5476 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_basics_with_console_tracing_custom_attributes.py:93

            model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #203a2985b0ef628a — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_azure_monitor_tracing.py:48

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08ff8ec37fb7197d — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_azure_monitor_tracing.py:83

application_insights_connection_string = os.environ["APPLICATIONINSIGHTS_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c81a095147978f1d — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_azure_monitor_tracing.py:93

            model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are a helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de40dd24bf66bfb5 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_console_tracing.py:67

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97c3d33afbbd72b6 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_stream_eventhandler_with_console_tracing.py:108

            model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are a helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c2cb70ab26015b8 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_azure_monitor_tracing.py:46

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c610c474ab0229e2 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_azure_monitor_tracing.py:51

application_insights_connection_string = os.environ["APPLICATIONINSIGHTS_CONNECTION_STRING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb2ed80f7dcdde3c — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_azure_monitor_tracing.py:99

            model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8966c989c660271 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_console_tracing.py:66

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97d10053fb0803bd — Environment-variable access.

pkgs/python/[email protected]/samples/agents_telemetry/sample_agents_toolset_with_console_tracing.py:112

            model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24ab8c1347a825c3 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_auto_function_call.py:33

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d38cce11957c308 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_auto_function_call.py:41

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d409c3f03ab5c126 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_auto_function_call.py:66

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1d40fabe6c7a0e4 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_azure_ai_search.py:43

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2920c0b0d64246e1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_azure_ai_search.py:48

conn_id = os.environ["AI_AZURE_AI_CONNECTION_ID"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a482e68982f84c1b — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_azure_ai_search.py:60

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #663531bd47fa930c — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_azure_functions.py:35

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b72f6b705efaef3d — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_azure_functions.py:42

    storage_service_endpoint = os.environ["STORAGE_SERVICE_ENDPONT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea39facfb9a9fe5c — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_azure_functions.py:65

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #baa27e09f04ce7eb — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_bing_grounding.py:35

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c530e1b62ec97d9 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_bing_grounding.py:40

conn_id = os.environ["AZURE_BING_CONNECTION_ID"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #358875f7844ccd63 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_bing_grounding.py:48

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddcaa873001b18f1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_code_interpreter.py:38

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de2feb9c0ed23f20 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_code_interpreter.py:53

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #742bfd546d109796 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_code_interpreter_attachment_enterprise_search.py:39

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2581623db1ae1c53 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_code_interpreter_attachment_enterprise_search.py:49

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #add2bc8d3c338e71 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_code_interpreter_attachment_enterprise_search.py:61

    asset_uri = os.environ["AZURE_BLOB_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6d821acb5708069 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_connected_agent.py:32

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11a9c15fbe98e069 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_connected_agent.py:39

    model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dae52cae5b53bbda — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_connected_agent.py:55

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fbc6330bb61a962 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_enterprise_file_search.py:32

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #60dc0e477f722f11 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_enterprise_file_search.py:40

    asset_uri = os.environ["AZURE_BLOB_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42696b59499546bc — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_enterprise_file_search.py:52

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07decc05fdec9225 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_file_search.py:37

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75b3cfc45dfb80e1 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_file_search.py:55

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39aa5c1446171239 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_functions.py:42

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4e0dd2a4daad997 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_functions.py:52

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43a2029242e9d394 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_logic_apps.py:61

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74da537bb8c63df8 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_logic_apps.py:66

subscription_id = os.environ["SUBSCRIPTION_ID"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27b7d84f454d8847 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_logic_apps.py:67

resource_group = os.environ["resource_group_name"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15ac97ea2b86472d — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_logic_apps.py:97

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b707d811b8d66b45 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_multiple_connected_agents.py:33

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dbe52fbc3f71eaa — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_multiple_connected_agents.py:41

    model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f7510b1a1d27fb3 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_multiple_connected_agents.py:49

    model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa6ce37f04c05e00 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_multiple_connected_agents.py:67

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #462afc95f3d7d650 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi.py:38

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0e9b1921640e088 — Filesystem access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi.py:43

with open(weather_asset_file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #025d423477226b58 — Filesystem access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi.py:46

with open(countries_asset_file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e3fc509d2a9b8d7 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi.py:63

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #224e281d764a2bca — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi_connection_auth.py:46

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12ea51ad2a3835a5 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi_connection_auth.py:50

model_name = os.environ["MODEL_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f831a0ba9336f1a — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi_connection_auth.py:51

connection_id = os.environ["OPENAPI_CONNECTION_ID"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68a003d4090a051b — Filesystem access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_openapi_connection_auth.py:55

with open(asset_file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b6d08bad771e334 — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_run_with_toolset.py:37

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b59b2f41767273c — Environment-variable access.

pkgs/python/[email protected]/samples/agents_tools/sample_agents_run_with_toolset.py:56

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29dfbd4a9783b0c1 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics.py:32

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9888715bb2f91178 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics.py:42

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e07378cdc8930c76 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_stream_eventhandler.py:40

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74ceab4da9636dfa — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_stream_eventhandler.py:77

        model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are a helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55c9ff1d6040f0bf — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_stream_iteration.py:37

    endpoint=os.environ["PROJECT_ENDPOINT"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9b3c45f5484167e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_stream_iteration.py:44

        model=os.environ["MODEL_DEPLOYMENT_NAME"], name="my-agent", instructions="You are a helpful agent"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5713361fac14687 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_thread_and_process_run.py:32

agents_client = AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=DefaultAzureCredential())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cf58fbed32881c7 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_thread_and_process_run.py:36

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #875c946ec611a72b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_thread_and_run.py:33

agents_client = AgentsClient(endpoint=os.environ["PROJECT_ENDPOINT"], credential=DefaultAzureCredential())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #905ae1f900905b57 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_agents_basics_thread_and_run.py:37

        model=os.environ["MODEL_DEPLOYMENT_NAME"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d5841a5b30b740e — Filesystem access.

pkgs/python/[email protected]/setup.py:22

with open(os.path.join(package_folder_path, "_version.py"), "r") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21b8d1bc118ef91d — Filesystem access.

pkgs/python/[email protected]/setup.py:33

    long_description=open("README.md", "r").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mistralai

python dependency

medium telemetry dependency Excluded from app score #cfd4b671a28d17ea — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/client/_hooks/traceparent.py:5

from opentelemetry.propagate import inject

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #15a2c4e2c1d28ef9 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/client/_hooks/tracing.py:8

from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b4c1f9978acc390a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/client/_hooks/tracing.py:9

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #91dd2c6407a8a791 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/client/_hooks/tracing.py:10

from opentelemetry.trace import Span, Status, StatusCode, set_span_in_context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6a62f213d568bbc7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/__init__.py:4

from opentelemetry import trace as otel_trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f31d05e6f3e2c3f2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:17

import opentelemetry.semconv._incubating.attributes.gen_ai_attributes as gen_ai_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1abf6a6de9442529 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:18

import opentelemetry.semconv._incubating.attributes.http_attributes as http_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #93f2fb4aa10c5376 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:19

import opentelemetry.semconv.attributes.error_attributes as error_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #948bd9587d68beb6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:20

import opentelemetry.semconv.attributes.server_attributes as server_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5dcaf9e2fcbefc69 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:21

from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e230d03376ddee8c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:22

from opentelemetry import propagate, trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #360fe750e9c07efa — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:23

from opentelemetry.baggage import get_baggage

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #dca4d6622c699ebd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:24

from opentelemetry.trace import Span, Status, StatusCode, Tracer, set_span_in_context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #881ba1d416aa7159 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/redaction.py:26

    from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #17f24c4a06ec6469 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/redaction.py:27

    from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #09055684199e8aa1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/redaction.py:102

        from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9b53cc6dfda0d086 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/redaction.py:103

        from opentelemetry.sdk.trace import Event, ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8a3eb16428939bdc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/redaction.py:104

        from opentelemetry.trace import Link, SpanKind, Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0ebbf984ed677e0e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/redaction_policies.py:14

from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #032856dbc65b7391 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:10

from opentelemetry import trace as otel_trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1f93e58006c2ed82 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:22

    from opentelemetry.sdk.trace import TracerProvider as SDKTracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6429da5e86127886 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:346

        from opentelemetry.exporter.otlp.proto.http.trace_exporter import (
            OTLPSpanExporter,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #732d4cc0e3ef9567 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:349

        from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6c739553df1e85e2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:350

        from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #773bc4be7d3261ec — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:351

        from opentelemetry.sdk.trace.export import BatchSpanProcessor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #114c5201be76ebe1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/run/tools.py:8

import opentelemetry.semconv._incubating.attributes.gen_ai_attributes as gen_ai_attributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e9e61761beab2b5e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/run/tools.py:16

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #36d1dde1fec9300e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/src/mistralai/extra/run/tools.py:17

from opentelemetry.trace import Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 11 low-confidence finding(s)

low env_fs dependency Excluded from app score #a9de4eb0c8736166 — Environment-variable access.

pkgs/python/[email protected]/packages/azure/src/mistralai/azure/client/utils/values.py:63

    env_value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7445695d7c1e1853 — Environment-variable access.

pkgs/python/[email protected]/packages/gcp/src/mistralai/gcp/client/utils/values.py:63

    env_value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f27412bbb937f46 — Environment-variable access.

pkgs/python/[email protected]/src/mistralai/client/utils/logger.py:25

    if os.getenv("MISTRAL_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #394fb29e3459c74a — Environment-variable access.

pkgs/python/[email protected]/src/mistralai/client/utils/security.py:80

    if os.getenv("MISTRAL_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86001ec10d46a7cd — Environment-variable access.

pkgs/python/[email protected]/src/mistralai/client/utils/security.py:81

        security_dict["api_key"] = os.getenv("MISTRAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45f776766b0f1a06 — Environment-variable access.

pkgs/python/[email protected]/src/mistralai/client/utils/values.py:64

    env_value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #b7c446dbfcc305c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/mistralai/extra/mcp/auth.py:109

    response = await async_client.post(register_endpoint, json=registration_payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #555d91b3192769f4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/mistralai/extra/mcp/sse.py:133

        response = httpx.get(
            self._sse_params.url,
            headers=self._format_headers(),
            timeout=self._sse_params.timeout,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #0ba1d2f5f5bfe0ac — Environment-variable access.

pkgs/python/[email protected]/src/mistralai/extra/observability/otel.py:40

    os.getenv("MISTRAL_SDK_DEBUG_TRACING", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40fa25a5abd0dbb4 — Environment-variable access.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:80

    env_value = os.getenv(MISTRAL_SDK_TELEMETRY_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b46225c2fb4fd54 — Environment-variable access.

pkgs/python/[email protected]/src/mistralai/extra/observability/telemetry.py:363

    return os.getenv(
        MISTRAL_OTLP_TRACES_ENDPOINT_ENV,
        MISTRAL_TELEMETRY_ENDPOINT,
    ).strip() or MISTRAL_TELEMETRY_ENDPOINT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

chromadb

python dependency

medium telemetry dependency Excluded from app score #ef0f5ab4bd427872 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/rust.py:226

        self.product_telemetry_client.capture(
            ClientCreateCollectionEvent(
                collection_uuid=str(id),
                # embedding_function=embedding_function.__class__.__name__,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #364b83c6ffb0a408 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/rust.py:429

        self.product_telemetry_client.capture(
            CollectionGetEvent(
                collection_uuid=str(collection_id),
                ids_count=ids_amount,
                limit=limit if limit else 0,
                include_metadata=ids_amount if "metadatas" in include else 0,
                include_documents=ids_amount if "documents" in include else 0,
                include_uris=ids_amount if "uris" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7ba2c96d484670fd — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/rust.py:474

        self.product_telemetry_client.capture(
            CollectionAddEvent(
                collection_uuid=str(collection_id),
                add_amount=len(ids),
                with_metadata=len(ids) if metadatas is not None else 0,
                with_documents=len(ids) if documents is not None else 0,
                with_uris=len(ids) if uris is not None else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d202c347dbe2fd2f — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/rust.py:507

        self.product_telemetry_client.capture(
            CollectionUpdateEvent(
                collection_uuid=str(collection_id),
                update_amount=len(ids),
                with_embeddings=len(embeddings) if embeddings else 0,
                with_metadata=len(metadatas) if metadatas else 0,
                with_documents=len(documents) if documents else 0,
                with_uris=len(uris) if uris else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f73e22e779aea87b — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/rust.py:567

        self.product_telemetry_client.capture(
            CollectionQueryEvent(
                collection_uuid=str(collection_id),
                query_amount=query_amount,
                filtered_ids_amount=filtered_ids_amount,
                n_results=n_results,
                with_metadata_filter=query_amount if where is not None else 0,
                with_document_filter=query_amount if where_document is not None else 0,
                include_metadatas=query_amount if "metadatas" in include else 0,
                include_documents=query_amount if "documents" in include else 0,
                include_uris=query_amount if "uris" in include else 0,
                include_distances=query_amount if "distances" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #871236e4895b7315 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/rust.py:626

        self.product_telemetry_client.capture(
            CollectionDeleteEvent(
                collection_uuid=str(collection_id),
                delete_amount=deleted,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #585e4f3d5659e1d6 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/segment.py:285

        self._product_telemetry_client.capture(
            ClientCreateCollectionEvent(
                collection_uuid=str(id),
                # embedding_function=embedding_function.__class__.__name__,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a4c354a694185eba — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/segment.py:552

        self._product_telemetry_client.capture(
            CollectionAddEvent(
                collection_uuid=str(collection_id),
                add_amount=len(ids),
                with_metadata=len(ids) if metadatas is not None else 0,
                with_documents=len(ids) if documents is not None else 0,
                with_uris=len(ids) if uris is not None else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ce88796527a8d821 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/segment.py:607

        self._product_telemetry_client.capture(
            CollectionUpdateEvent(
                collection_uuid=str(collection_id),
                update_amount=len(ids),
                with_embeddings=len(embeddings) if embeddings else 0,
                with_metadata=len(metadatas) if metadatas else 0,
                with_documents=len(documents) if documents else 0,
                with_uris=len(uris) if uris else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ec774ad63e266c4f — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/segment.py:714

        self._product_telemetry_client.capture(
            CollectionGetEvent(
                collection_uuid=str(collection_id),
                ids_count=ids_amount,
                limit=limit if limit else 0,
                include_metadata=ids_amount if "metadatas" in include else 0,
                include_documents=ids_amount if "documents" in include else 0,
                include_uris=ids_amount if "uris" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4c9549245ea74bdc — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/segment.py:825

        self._product_telemetry_client.capture(
            CollectionDeleteEvent(
                collection_uuid=str(collection_id), delete_amount=deleted_count
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #038fc29aeb0adb74 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/segment.py:890

        self._product_telemetry_client.capture(
            CollectionQueryEvent(
                collection_uuid=str(collection_id),
                query_amount=query_amount,
                filtered_ids_amount=ids_amount,
                n_results=n_results,
                with_metadata_filter=query_amount if where is not None else 0,
                with_document_filter=query_amount if where_document is not None else 0,
                include_metadatas=query_amount if "metadatas" in include else 0,
                include_documents=query_amount if "documents" in include else 0,
                include_uris=query_amount if "uris" in include else 0,
                include_distances=query_amount if "distances" in include else 0,
            )
        )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2266d1bd15888fe7 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/api/shared_system_client.py:137

        telemetry_client.capture(ClientStartEvent())

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6dab74a014d93e11 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/execution/executor/distributed.py:22

from opentelemetry.trace import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7061dc7770030e85 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/proto/utils.py:4

from opentelemetry.trace import Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cf45c20ebf67b089 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/server/fastapi/__init__.py:77

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d8338caaf38b0ef7 — Structural telemetry/analytics emit (event capture or batched event insert). Confirm user consent and what payload is sent to the destination.

pkgs/python/[email protected]/chromadb/server/fastapi/__init__.py:245

        telemetry_client.capture(ServerStartEvent())

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #53da37d8a284fb7d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:7

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f3a2a11bc39a40df — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:8

from opentelemetry.sdk.resources import SERVICE_NAME, Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #427a8278367b562f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:9

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2cb398da740504a2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:10

from opentelemetry.sdk.trace.export import (
    BatchSpanProcessor,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #40fd6bf065d527bf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:13

from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #37b084dae6e71040 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/fastapi.py:3

from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f62e72d41ef1da61 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/grpc.py:5

from opentelemetry.trace import StatusCode, SpanKind

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 67 low-confidence finding(s)

low env_fs dependency Excluded from app score #1c5c6a58834e6136 — Environment-variable access.

pkgs/python/[email protected]/chromadb/__init__.py:407

            arg.value = arg.value or os.environ.get(arg.env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #116f2b825a0aae78 — Environment-variable access.

pkgs/python/[email protected]/chromadb/__init__.py:420

    tenant = tenant or os.environ.get("CHROMA_TENANT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4fa216afc9c691f7 — Environment-variable access.

pkgs/python/[email protected]/chromadb/__init__.py:423

    database = database or os.environ.get("CHROMA_DATABASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #be36203601430798 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/api/async_fastapi.py:167

        response = await self._get_client().request(method, url, **cast(Any, kwargs))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9bb43750daf420b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/api/fastapi.py:131

        response = self._session.request(method, url, **cast(Any, kwargs))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #40d5b86b7f1e5a2f — Filesystem access.

pkgs/python/[email protected]/chromadb/auth/__init__.py:124

            with open(_creds_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f50946931333051a — Filesystem access.

pkgs/python/[email protected]/chromadb/auth/__init__.py:235

            with open(_config_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #4353fcb328d6cbcc — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/cli/cli.py:25

        response = requests.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #6ff95a926bd57fdb — Filesystem access.

pkgs/python/[email protected]/chromadb/cli/utils.py:12

    with open(f"{log_config_path}", "r") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #264db65b0f20aac7 — Filesystem access.

pkgs/python/[email protected]/chromadb/db/migrations.py:256

    sql = file["path"].read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbfc65dc1cc878a7 — Filesystem access.

pkgs/python/[email protected]/chromadb/segment/impl/vector/local_persistent_hnsw.py:74

        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87d7aa44ad36f3eb — Filesystem access.

pkgs/python/[email protected]/chromadb/segment/impl/vector/local_persistent_hnsw.py:255

        with open(self._get_metadata_file(), "wb") as metadata_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9076f4ecd075b51e — Environment-variable access.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:139

                        {"pod_name": os.environ.get("HOSTNAME")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08551f9585618ffd — Environment-variable access.

pkgs/python/[email protected]/chromadb/telemetry/opentelemetry/__init__.py:155

                        {"pod_name": os.environ.get("HOSTNAME")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8224616586f4140 — Filesystem access.

pkgs/python/[email protected]/chromadb/telemetry/product/__init__.py:88

                with open(self.USER_ID_PATH, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56ab0783b3bc18b7 — Filesystem access.

pkgs/python/[email protected]/chromadb/telemetry/product/__init__.py:93

                with open(self.USER_ID_PATH, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d4f7280466b17c1 — Environment-variable access.

pkgs/python/[email protected]/chromadb/telemetry/product/events.py:20

        self.is_cli = os.environ.get("CHROMA_CLI", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #735ad965b75605ce — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/baseten_embedding_function.py:39

        if os.getenv("BASETEN_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31523f658d117b64 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/baseten_embedding_function.py:45

        resolved_api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0116973c5f3b9a9 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_qwen_embedding_function.py:61

        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8074f416eb08e346 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_qwen_embedding_function.py:127

        response = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #30e342b5ef9cb1cf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_qwen_embedding_function.py:149

        response = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #d2b9f68e3101dab3 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_splade_embedding_function.py:42

        self.api_key = os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #e7eabba65cf6d394 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/chroma_cloud_splade_embedding_function.py:99

            response = self._session.post(self._api_url, json=payload, timeout=60)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #0aa45f450d913481 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:57

        if os.getenv("CLOUDFLARE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b47461e555e718f — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:62

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #9ede884634160da0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/cloudflare_workers_ai_embedding_function.py:99

        resp = self._session.post(self._api_url, json=payload).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #9f567eea4fb819ad — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/cohere_embedding_function.py:46

        if os.getenv("COHERE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66056613cccf2a62 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/cohere_embedding_function.py:51

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d151d98b023397c9 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:57

        self.api_key = os.getenv(self.api_key_env_var) if self.api_key_env_var else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6beff34c7b026d4 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:251

        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1ac39426dd113e3 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:256

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd74ac4a5fb5f653 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:401

        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #045eb1fb3093d7a6 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:406

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #733aca6a3961dcf4 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:529

        if os.getenv("GOOGLE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6e057fa8559e416 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/google_embedding_function.py:534

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #779ac03e6be007d6 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:43

        if os.getenv("HUGGINGFACE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8df68531802251a9 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:48

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #c6b503487f1aff4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:76

        response = self._session.post(
            self._api_url,
            json={"inputs": input, "options": {"wait_for_model": True}},
        ).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8d9227072fafaa52 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:169

        if os.getenv("HUGGINGFACE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31e55fea0c632cac — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:173

            self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #c27bcd11ddd05e6d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/huggingface_embedding_function.py:199

        response = self._session.post(self._api_url, json={"inputs": input}).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2655b5f9530bf6d5 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:84

        if os.getenv("JINA_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e8d5ad3ecf8297a — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:89

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #5f5b0eef28ddfd70 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:202

        resp = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0c9574cfbc25d912 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/jina_embedding_function.py:210

        resp = self._session.post(self._api_url, json=payload, timeout=60).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8cee4ed11b13820d — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/mistral_embedding_function.py:29

        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67b5f0b3dc4eb39a — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/morph_embedding_function.py:49

        self.api_key = api_key or os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b5cf6054c130a3c — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/nomic_embedding_function.py:50

        self.api_key = os.getenv(api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21b7635ff6e3c46d — Filesystem access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/onnx_mini_lm_l6_v2.py:24

    with open(fname, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40080f4c045ae5d9 — Filesystem access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/onnx_mini_lm_l6_v2.py:109

            with open(fname, "wb") as file, self.tqdm(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d151db5430814d3e — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/openai_embedding_function.py:60

        if os.getenv("OPENAI_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bbe70498abd3f5f — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/openai_embedding_function.py:65

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f88b8cffbb0de56 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/perplexity_embedding_function.py:52

        if os.getenv("PERPLEXITY_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbb9ed3d56a8a5b5 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/perplexity_embedding_function.py:57

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ca3eed7f49a6ff1 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:48

        if os.getenv("ROBOFLOW_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b7588371e44c3d0 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:53

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #65831ecd437f3c08 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:97

                res = self._httpx.post(
                    f"{self.api_url}/clip/embed_image?api_key={self.api_key}",
                    json=infer_clip_payload_image,
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5b0b16fbbeb2cde0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/roboflow_embedding_function.py:110

                res = self._httpx.post(
                    f"{self.api_url}/clip/embed_text?api_key={self.api_key}",
                    json=infer_clip_payload_text,
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #c1690328375933cd — Filesystem access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/schemas/registry.py:38

        with open(schema_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3240f912adf8db6c — Filesystem access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/schemas/schema_utils.py:36

    with open(schema_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b2bbee875d847ae — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:52

        if os.getenv("TOGETHER_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #162dacb9383ed2e4 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:57

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #831254569b70d614 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/together_ai_embedding_function.py:89

        response = self._session.post(
            ENDPOINT,
            json={"model": self.model_name, "input": input},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #084cc4b8c834d1cc — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/utils.py:11

    return (os.environ.get("CHROMA_EMBED_URL") or DEFAULT_CHROMA_EMBED_URL).rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c6aa7ba9283fdd5 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/voyageai_embedding_function.py:50

        if os.getenv("VOYAGE_API_KEY") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b329dfdd7847b3d0 — Environment-variable access.

pkgs/python/[email protected]/chromadb/utils/embedding_functions/voyageai_embedding_function.py:55

        self.api_key = api_key or os.getenv(self.api_key_env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

semantic-kernel

python dependency

medium telemetry dependency Excluded from app score #e2b4cb92c09bcb69 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/propagation.py:7

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #abdec641893408c2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/propagation.py:8

from opentelemetry.propagate import extract

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #de794ebd335cb1ac — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/propagation.py:9

from opentelemetry.trace import Link, get_current_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #42ee7622f7556339 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/propagation.py:10

from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d5304eb59707ecd0 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/tracing.py:7

from opentelemetry.trace import NoOpTracerProvider, Span, SpanKind, TracerProvider, get_tracer_provider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #8ffb28a1faf92990 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/tracing.py:8

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #9c39fd02b4f6b118 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/tracing_config.py:7

from opentelemetry.trace import SpanKind

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #026d8c3bf7dbb86a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/core/telemetry/tracing_config.py:8

from opentelemetry.util import types

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #eadc69e9ea5b97df — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/agents/runtime/in_process/in_process_runtime.py:21

from opentelemetry.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #70e6da28df7f51a2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/connectors/ai/chat_completion_client_base.py:11

from opentelemetry.trace import Span, Tracer, get_tracer, use_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4069ae0619815761 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/functions/kernel_function.py:12

from opentelemetry import metrics, trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5a38ba6b05d4326a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/functions/kernel_function.py:13

from opentelemetry.semconv.attributes.error_attributes import ERROR_TYPE

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #7b58de61b236de5f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/utils/telemetry/agent_diagnostics/decorators.py:9

from opentelemetry.trace import Span, StatusCode, get_tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #375cdbc595a8efc5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/utils/telemetry/model_diagnostics/decorators.py:10

from opentelemetry.trace import Span, StatusCode, get_tracer, use_span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b84b5fb42b4d8505 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/semantic_kernel/utils/telemetry/model_diagnostics/function_tracer.py:5

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 36 low-confidence finding(s)

low env_fs dependency Excluded from app score #64f5ab814f0a6bda — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/agents/agent.py:866

            with open(file_path, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b14be017a8b43d1 — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:144

                "private_key": Path(self.client_cert_path).read_text(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #743271e43d756eae — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:182

        pem_bytes = Path(cert_path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1fb8af51d835390 — Environment-variable access.

pkgs/python/[email protected]/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:390

        cache_file = environ.get("TOKEN_CACHE_PATH_INTERACTIVE") or path.join(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8ca0b2dab443bb4 — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/connectors/ai/onnx/services/onnx_gen_ai_completion_base.py:43

            with open(json_gen_ai_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #5a0f92ddd419a066 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/connectors/ai/open_ai/services/_open_ai_realtime.py:805

                session.post(self._get_webrtc_url(), headers=headers, data=offer.sdp) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #95fd2fda08a737a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/connectors/ai/open_ai/services/_open_ai_realtime.py:902

                session.post(url, headers=headers, json=data) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #799f9f0990749669 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/connectors/ai/open_ai/services/azure_realtime.py:363

                session.post(url, headers=headers, json=data) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #288e60b12adf6a49 — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/connectors/ai/open_ai/services/open_ai_handler.py:167

            with open(settings.filename, "rb") as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #3afea836f1c453a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/connectors/brave.py:230

                response = await client.get(url, headers=headers, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f9c13cd160c777e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/connectors/google_search.py:268

                response = await client.get(full_url, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a5acdcb829cd10d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/connectors/memory_stores/astradb/astra_client.py:52

            session.post(request_url, data=json.dumps(query), headers=self.request_header) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #55162a0069790801 — Environment-variable access.

pkgs/python/[email protected]/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:47

    elif os.getenv(ENV_VAR_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #569e8f61705ead7e — Environment-variable access.

pkgs/python/[email protected]/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:48

        service_endpoint = os.getenv(ENV_VAR_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfa1cae4097f2b0f — Environment-variable access.

pkgs/python/[email protected]/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:63

    elif os.getenv(ENV_VAR_API_KEY):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96c597b11784be73 — Environment-variable access.

pkgs/python/[email protected]/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:64

        azure_credential = AzureKeyCredential(os.getenv(ENV_VAR_API_KEY))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #d424c8dae03c4459 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/connectors/utils/document_loader.py:39

                response = await client.get(url, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #00be7d0e0e4497b6 — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/contents/audio_content.py:83

        with open(path, "rb") as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec700b5174493bea — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/contents/binary_content.py:206

        data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0bb8425d0a2e5a84 — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/contents/binary_content.py:257

        with open(path, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #723665400da018f5 — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/contents/chat_history.py:422

        with open(file_path, "w") as local_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cad0093541c197b — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/contents/chat_history.py:437

        with open(file_path) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f806650734e4269b — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/contents/image_content.py:100

        with open(path, "rb") as image_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #44068c8eb79707c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/core_plugins/crew_ai/crew_ai_enterprise_client.py:47

            self.session.get(f"{self.endpoint}/inputs", headers=self.request_header) as response,  # type: ignore

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #87c15501209b05bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/core_plugins/crew_ai/crew_ai_enterprise_client.py:77

            self.session.post(f"{self.endpoint}/kickoff", json=content, headers=self.request_header) as response,  # type: ignore

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #28f16a7c8074b1c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/core_plugins/crew_ai/crew_ai_enterprise_client.py:93

            self.session.get(f"{self.endpoint}/status/{task_id}", headers=self.request_header) as response,  # type: ignore

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b92e04b0e427dc3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/core_plugins/http_plugin.py:150

            session.get(url, raise_for_status=True, allow_redirects=self._allow_redirects) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #827259323fadde96 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/core_plugins/http_plugin.py:174

            session.post(
                url, headers=headers, data=data, raise_for_status=True, allow_redirects=self._allow_redirects
            ) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1fd20b72fec5e9c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/semantic_kernel/core_plugins/http_plugin.py:201

            session.put(
                url, headers=headers, data=data, raise_for_status=True, allow_redirects=self._allow_redirects
            ) as response,

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #4767af297c0dd84d — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py:372

            with open(validated_path, "rb") as data:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b37934b212f227f — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/core_plugins/sessions_python_tool/sessions_python_plugin.py:457

                with open(validated_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2a3f88a86daf7aa — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/functions/kernel_function_from_prompt.py:399

        with open(config_path, encoding=encoding) as config_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10acdc5eb8576f2f — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/functions/kernel_function_from_prompt.py:403

        with open(prompt_path, encoding=encoding) as prompt_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5672aa6a325010de — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/functions/kernel_plugin.py:322

                with open(object, encoding=encoding) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fee88da809b725b5 — Filesystem access.

pkgs/python/[email protected]/semantic_kernel/processes/kernel_process/kernel_process_step_state_metadata.py:69

            with open(file_path, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1944add25e6b7a3 — Environment-variable access.

pkgs/python/[email protected]/semantic_kernel/utils/telemetry/user_agent.py:12

IS_TELEMETRY_ENABLED = os.environ.get(TELEMETRY_DISABLED_ENV_VAR, "false").lower() not in ["true", "1"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redis

python dependency

medium telemetry dependency Excluded from app score #f114ec4143ce5d56 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/asyncio/observability/recorder.py:247

        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c6a47e0b124228c4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/metrics.py:37

    from opentelemetry.metrics import Meter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b497cea53c193c75 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/providers.py:32

    from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #43c7e7e58e4631e4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/providers.py:76

            from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f92301643799efa8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/providers.py:77

            from opentelemetry.metrics import NoOpMeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fd4799fb5254c706 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/recorder.py:242

        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1f7925d8c22d5e91 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/recorder.py:727

    from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #751af520c9a677c1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/registry.py:8

        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 6 low-confidence finding(s)

low egress dependency Excluded from app score #02e19447773424f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/asyncio/multidb/healthcheck.py:505

        await self._http_client.get(url, expect_json=False)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #dfc0b4a9f712b706 — Filesystem access.

pkgs/python/[email protected]/redis/commands/json/__init__.py:303

            with open(fp) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c7253a580d2fb9b — Filesystem access.

pkgs/python/[email protected]/redis/commands/json/commands.py:650

        with open(file_name) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #803168e2d96b3442 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/http/http_client.py:309

        with urlopen(request, timeout=timeout or self.timeout, context=context) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #807dc1df2c2d3a85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/ocsp.py:272

        r = requests.get(issuer_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #27e20a8c084effe6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/ocsp.py:285

        r = requests.get(ocsp_url, headers=header)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

azure-ai-inference

python dependency

medium telemetry dependency Excluded from app score #3931d0588562db51 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/azure/ai/inference/tracing.py:24

    from opentelemetry.trace import StatusCode, Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d7daf65e6994bc6c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_chat_completions_with_azure_monitor_tracing.py:31

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3e367774fda10332 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_chat_completions_with_azure_monitor_tracing.py:39

from opentelemetry.trace import get_tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #188a30afee159726 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tracing.py:32

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0aa7cdb5231a99ea — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tracing.py:35

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f7674a433a536325 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tracing.py:36

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #43c3cee7900b57a8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tracing.py:55

from opentelemetry.trace import get_tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 93 low-confidence finding(s)

low env_fs dependency Excluded from app score #4f8396877d392958 — Filesystem access.

pkgs/python/[email protected]/azure/ai/inference/models/_patch.py:320

        with open(image_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21110937c93dac40 — Filesystem access.

pkgs/python/[email protected]/azure/ai/inference/models/_patch.py:346

        with open(image_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9a1bd4de836e1ca — Filesystem access.

pkgs/python/[email protected]/azure/ai/inference/models/_patch.py:548

        with open(audio_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f63ec27c3e194101 — Environment-variable access.

pkgs/python/[email protected]/azure/ai/inference/prompts/_core.py:190

        if variable in os.environ.keys():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd9b2cbf3c873244 — Environment-variable access.

pkgs/python/[email protected]/azure/ai/inference/prompts/_core.py:191

            return os.environ[variable]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7caed2b723c69d2 — Filesystem access.

pkgs/python/[email protected]/azure/ai/inference/prompts/_parsers.py:64

        with open(image_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85540f68e17d815c — Filesystem access.

pkgs/python/[email protected]/azure/ai/inference/prompts/_tracer.py:306

        with open(trace_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c45c58982b983ffd — Filesystem access.

pkgs/python/[email protected]/azure/ai/inference/prompts/_utils.py:22

    with open(file_path, "r", encoding=encoding) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00a17ee7848f7e44 — Environment-variable access.

pkgs/python/[email protected]/azure/ai/inference/tracing.py:147

            var_value = os.environ.get("AZURE_TRACING_GEN_AI_CONTENT_RECORDING_ENABLED")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0220894069ef0f4 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_async.py:35

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fdfdb2ddcd3fa98 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_async.py:36

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #320c4f1591ba9e33 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_from_input_bytes_async.py:37

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8ce494ad35a46c6 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_from_input_bytes_async.py:38

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e04177352763fc8 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_from_input_dict_async.py:38

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4e632f9f3927142 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_from_input_dict_async.py:39

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37f1546821368c0e — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_streaming_async.py:36

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bca3e348c3366d97 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_streaming_async.py:37

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e6eaf3fc84ac244 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_streaming_azure_openai_async.py:38

        endpoint = os.environ["AZURE_OPENAI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15f4ff2f0992fb18 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_chat_completions_streaming_azure_openai_async.py:50

            key = os.environ["AZURE_OPENAI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfaaf961f1932084 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_embeddings_async.py:34

        endpoint = os.environ["AZURE_AI_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21e97b5ef15dbcd3 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_embeddings_async.py:35

        key = os.environ["AZURE_AI_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83d272820c01eefb — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_image_embeddings_async.py:32

        endpoint = os.environ["AZURE_AI_IMAGE_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84314235fcfd571e — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_image_embeddings_async.py:33

        key = os.environ["AZURE_AI_IMAGE_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0213858bc9650c0 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_load_client_async.py:30

        endpoint = os.environ["AZURE_AI_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99c5d27fca153fe5 — Environment-variable access.

pkgs/python/[email protected]/samples/async_samples/sample_load_client_async.py:31

        key = os.environ["AZURE_AI_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc4cfa1413441e15 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions.py:31

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9c6cad90d2a169b — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions.py:32

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c27a4349e054df12 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_azure_openai.py:36

        endpoint = os.environ["AZURE_OPENAI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20cb29b71952197a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_azure_openai.py:48

            key = os.environ["AZURE_OPENAI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3613e55a22800daa — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_bytes.py:37

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d9993aeb77276aa — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_bytes.py:38

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cb2b5ce3f8952e4 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_dict.py:38

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9094f88346a56bcb — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_dict.py:39

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c417edaaaa8fdd95 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_dict_with_image_url.py:42

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dec0540ff483421 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_dict_with_image_url.py:43

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28859403ac8efae3 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_dict_with_image_url.py:50

        model_deployment = os.environ["AZURE_AI_CHAT_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe52412dfed875e2 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_prompt_string.py:36

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad21a99baedd0ab0 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_prompt_string.py:37

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43046ee1b03cd772 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_prompty.py:36

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58483bd24facdfac — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_from_input_prompty.py:37

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5d250088a22c212 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming.py:31

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6adb5e6472313597 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming.py:32

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07523eeba2ac76dc — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming_with_entra_id_auth.py:31

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea4be395dd0f949a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming_with_entra_id_auth.py:38

        model_deployment = os.environ["AZURE_AI_CHAT_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb17eefa0dfa692f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming_with_tools.py:45

            endpoint = os.environ["AZURE_OPENAI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc39006b50c9a454 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming_with_tools.py:46

            key = os.environ["AZURE_OPENAI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a34dc3fe494d4274 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming_with_tools.py:48

            endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e84a269c3f43054e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_streaming_with_tools.py:49

            key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5c314a58415422d — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_audio_data.py:47

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #418de3b4e0ad2f22 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_audio_data.py:48

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #716a096613662aab — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_audio_data.py:55

        model_deployment = os.environ["AZURE_AI_CHAT_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b291b89484d6d3dd — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_azure_monitor_tracing.py:151

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9138152fd8a58ab — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_azure_monitor_tracing.py:152

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3ba9551610f5478 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_defaults.py:33

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbad6908c659b903 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_defaults.py:34

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d4415f1ee240ec5 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_entra_id_auth.py:42

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7742a6726fbd4ebe — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_entra_id_auth.py:43

        model_deployment_name = os.environ["AZURE_AI_CHAT_MODEL_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #153c5179c92026f0 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_history.py:32

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2bb2d0136603f8c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_history.py:33

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53b7a23f8191822f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_image_data.py:47

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #892058d0319f3a5a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_image_data.py:48

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce1fdb25bf203975 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_image_data.py:55

        model_deployment = os.environ["AZURE_AI_CHAT_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2fd66529ddbf99dd — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_image_url.py:47

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88f7d399d1c8a80f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_image_url.py:48

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0507b239d87847e3 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_image_url.py:55

        model_deployment = os.environ["AZURE_AI_CHAT_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c161773b2e9601f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_model_extras.py:33

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #625b3dd9d203d766 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_model_extras.py:34

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e3bb07845cf51e0 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_structured_output.py:54

        endpoint = os.environ["AZURE_OPENAI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81d49cfdcbf13870 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_structured_output.py:55

        key = os.environ["AZURE_OPENAI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a72a85b9a43c271e — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_structured_output_pydantic.py:57

        endpoint = os.environ["AZURE_OPENAI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea7f9c7b313318c4 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_structured_output_pydantic.py:58

        key = os.environ["AZURE_OPENAI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #483ee6c278d0d315 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tools.py:34

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a82bdd4eecda0ca9 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tools.py:35

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2f5f868c05b0f9c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tracing.py:170

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31cb61c378a95e26 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_chat_completions_with_tracing.py:171

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2c96613843c29cf — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings.py:32

        endpoint = os.environ["AZURE_AI_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25f99b60c052352c — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings.py:33

        key = os.environ["AZURE_AI_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac9c79b7fa3e1c14 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings_azure_openai.py:36

        endpoint = os.environ["AZURE_OPENAI_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f80c21de06fbcdc — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings_azure_openai.py:48

            key = os.environ["AZURE_OPENAI_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eda0a31027a7b866 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings_with_base64_encoding.py:32

        endpoint = os.environ["AZURE_AI_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3bf61fb973757a02 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings_with_base64_encoding.py:33

        key = os.environ["AZURE_AI_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ce6a5f3859bf284 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings_with_defaults.py:33

        endpoint = os.environ["AZURE_AI_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6956dc2f61d3d4aa — Environment-variable access.

pkgs/python/[email protected]/samples/sample_embeddings_with_defaults.py:34

        key = os.environ["AZURE_AI_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1ee7694a422ff01 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_get_model_info.py:30

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #384b7570d63f5509 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_get_model_info.py:31

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c84381ba6a46d9f — Environment-variable access.

pkgs/python/[email protected]/samples/sample_image_embeddings.py:31

        endpoint = os.environ["AZURE_AI_IMAGE_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c305a8ca2e970b7a — Environment-variable access.

pkgs/python/[email protected]/samples/sample_image_embeddings.py:32

        key = os.environ["AZURE_AI_IMAGE_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccaea18912fa2281 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_image_embeddings_with_defaults.py:33

        endpoint = os.environ["AZURE_AI_IMAGE_EMBEDDINGS_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17640048d7d013d5 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_image_embeddings_with_defaults.py:34

        key = os.environ["AZURE_AI_IMAGE_EMBEDDINGS_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed0e701b3e509bcf — Environment-variable access.

pkgs/python/[email protected]/samples/sample_load_client.py:30

        endpoint = os.environ["AZURE_AI_CHAT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #662626ec01e55cf2 — Environment-variable access.

pkgs/python/[email protected]/samples/sample_load_client.py:31

        key = os.environ["AZURE_AI_CHAT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03baa5a69a00f0d9 — Filesystem access.

pkgs/python/[email protected]/setup.py:22

with open(os.path.join(package_folder_path, "_version.py"), "r") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5925ecba631987c0 — Filesystem access.

pkgs/python/[email protected]/setup.py:33

    long_description=open("README.md", "r").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-cosmos

python dependency

medium telemetry dependency Excluded from app score #7726999fca9b4d43 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/tracing_open_telemetry.py:36

from opentelemetry import trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6f6b8545cfdd3863 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/tracing_open_telemetry.py:37

from opentelemetry.sdk.trace import TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c2868960dbd830e6 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/samples/tracing_open_telemetry.py:38

from opentelemetry.sdk.trace.export import SimpleSpanProcessor, ConsoleSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 56 low-confidence finding(s)

low env_fs dependency Excluded from app score #dc4e78b2d490cdd4 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_cosmos_client_connection.py:246

            scope_override = os.environ.get(Constants.AAD_SCOPE_OVERRIDE, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b38298a9bfae40a — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_cosmos_http_logging_policy.py:324

                multi_record = os.environ.get(HttpLoggingPolicy.MULTI_RECORD_LOG, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4975cc9ce506149c — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_cosmos_http_logging_policy.py:461

                multi_record = os.environ.get(HttpLoggingPolicy.MULTI_RECORD_LOG, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4541c91057b0992 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_execution_context/aio/execution_dispatcher.py:139

            if total_item_buffer > int(os.environ.get(Constants.MAX_ITEM_BUFFER_VS_CONFIG,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #368f6b213bbe28fa — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_execution_context/aio/execution_dispatcher.py:139

            if total_item_buffer > int(os.environ.get(Constants.MAX_ITEM_BUFFER_VS_CONFIG,
                                                      Constants.MAX_ITEM_BUFFER_VS_CONFIG_DEFAULT)):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #387b64e55a1a4db6 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_execution_context/execution_dispatcher.py:60

    if hybrid_search_query_info['take'] > int(os.environ.get(Constants.HS_MAX_ITEMS_CONFIG,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f48227ba7bec5664 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_execution_context/execution_dispatcher.py:60

    if hybrid_search_query_info['take'] > int(os.environ.get(Constants.HS_MAX_ITEMS_CONFIG,
                                                             Constants.HS_MAX_ITEMS_CONFIG_DEFAULT)):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dffd4b38ca7e781d — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_execution_context/execution_dispatcher.py:169

            if total_item_buffer > int(os.environ.get(Constants.MAX_ITEM_BUFFER_VS_CONFIG,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f3dd2fa50638462 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_execution_context/execution_dispatcher.py:169

            if total_item_buffer > int(os.environ.get(Constants.MAX_ITEM_BUFFER_VS_CONFIG,
                                                      Constants.MAX_ITEM_BUFFER_VS_CONFIG_DEFAULT)):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6eb07c661e59d70c — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_global_partition_endpoint_manager_circuit_breaker_core.py:64

        circuit_breaker_enabled = os.environ.get(Constants.CIRCUIT_BREAKER_ENABLED_CONFIG,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1d121f386be2b13 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_global_partition_endpoint_manager_circuit_breaker_core.py:64

        circuit_breaker_enabled = os.environ.get(Constants.CIRCUIT_BREAKER_ENABLED_CONFIG,
                                                 Constants.CIRCUIT_BREAKER_ENABLED_CONFIG_DEFAULT).lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e543001ee05e74b — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_global_partition_endpoint_manager_per_partition_automatic_failover.py:132

                    >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dedf7632e6bfc4b0 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_global_partition_endpoint_manager_per_partition_automatic_failover.py:132

                    >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,
                                          Constants.TIMEOUT_ERROR_THRESHOLD_PPAF_DEFAULT))):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #497fffba37d7f3e6 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_global_partition_endpoint_manager_per_partition_automatic_failover.py:140

                            >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5b70b2a1722c39c — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_global_partition_endpoint_manager_per_partition_automatic_failover.py:140

                            >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,
                                                  Constants.TIMEOUT_ERROR_THRESHOLD_PPAF_DEFAULT))):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4e79849c8dc412d — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_health_check_retry_policy.py:34

        self.retry_after_in_milliseconds = int(os.getenv(
            _constants._Constants.AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS,
            str(_constants._Constants.AZURE_COSMOS_HEALTH_CHECK_RETRY_AFTER_MS_DEFAULT)
        ))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b21c8baf3086d6af — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_health_check_retry_policy.py:38

        self.max_retry_attempt_count = int(os.getenv(
            _constants._Constants.AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES,
            str(_constants._Constants.AZURE_COSMOS_HEALTH_CHECK_MAX_RETRIES_DEFAULT)
        ))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df5aace7ccf1766a — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_inference_service.py:69

        semantic_reranking_inference_endpoint = os.environ.get(Constants.SEMANTIC_RERANKER_INFERENCE_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d8ce57e883b9d06 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_partition_health_tracker.py:224

        failure_rate_threshold = int(os.environ.get(Constants.FAILURE_PERCENTAGE_TOLERATED,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6df3cb33cc3e092 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_partition_health_tracker.py:224

        failure_rate_threshold = int(os.environ.get(Constants.FAILURE_PERCENTAGE_TOLERATED,
                                               Constants.FAILURE_PERCENTAGE_TOLERATED_DEFAULT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87d51583ec480c86 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_partition_health_tracker.py:254

        consecutive_failure_threshold = int(os.environ.get(env_key, default_consecutive_threshold))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c91b9400d4cf71f — Filesystem access.

pkgs/python/[email protected]/azure/cosmos/_query_advisor/_rule_directory.py:46

            resource_text = (
                files(__package__)
                .joinpath("query_advice_rules.json")
                .read_text(encoding="utf-8")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf6bcb74a87a7e4f — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_response_decoding.py:49

    raw_value = os.environ.get(_MALFORMED_INPUT_ENV_VAR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84cb35a81a88e63d — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_utils.py:173

    ppcb_check = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #233bd1b242bd2222 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_utils.py:173

    ppcb_check = os.environ.get(
        _Constants.CIRCUIT_BREAKER_ENABLED_CONFIG,
        _Constants.CIRCUIT_BREAKER_ENABLED_CONFIG_DEFAULT
    ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb242e929907a4b6 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_vector_session_token.py:121

        false_progress_merge_enabled = (os.environ.get(_Constants.SESSION_TOKEN_FALSE_PROGRESS_MERGE_CONFIG,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35ea91df401f7b46 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/_vector_session_token.py:121

        false_progress_merge_enabled = (os.environ.get(_Constants.SESSION_TOKEN_FALSE_PROGRESS_MERGE_CONFIG,
                                                       _Constants.SESSION_TOKEN_FALSE_PROGRESS_MERGE_CONFIG_DEFAULT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7536680aead34986 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/aio/_cosmos_client_connection_async.py:239

            scope_override = os.environ.get(Constants.AAD_SCOPE_OVERRIDE, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac13fcd99c27e2ad — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/aio/_global_partition_endpoint_manager_per_partition_automatic_failover_async.py:133

                    >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #def467b2a7f3877a — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/aio/_global_partition_endpoint_manager_per_partition_automatic_failover_async.py:133

                    >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,
                                          Constants.TIMEOUT_ERROR_THRESHOLD_PPAF_DEFAULT))):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a0f2d1fda383d59 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/aio/_global_partition_endpoint_manager_per_partition_automatic_failover_async.py:141

                            >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef5cd9ce0737bd56 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/aio/_global_partition_endpoint_manager_per_partition_automatic_failover_async.py:141

                            >= int(os.environ.get(Constants.TIMEOUT_ERROR_THRESHOLD_PPAF,
                                                  Constants.TIMEOUT_ERROR_THRESHOLD_PPAF_DEFAULT))):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff24f7336db42689 — Environment-variable access.

pkgs/python/[email protected]/azure/cosmos/aio/_inference_service_async.py:70

        semantic_reranking_inference_endpoint = os.environ.get(Constants.SEMANTIC_RERANKER_INFERENCE_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc72c7d827443ffb — Environment-variable access.

pkgs/python/[email protected]/samples/concurrency_sample.py:19

CONN_STR = os.environ['CONN_STR']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e54431f9bcc12a29 — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:9

    'host': os.environ.get('ACCOUNT_HOST', '[YOUR ENDPOINT]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed657cb7bf7cc2ce — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:10

    'master_key': os.environ.get('ACCOUNT_KEY', '[YOUR KEY]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9364b4c8d0208376 — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:11

    'database_id': os.environ.get('COSMOS_DATABASE', '[YOUR DATABASE]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73b5fa46971e06ff — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:12

    'container_id': os.environ.get('COSMOS_CONTAINER', '[YOUR CONTAINER]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce55c73ef12cf829 — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:13

    'tenant_id': os.environ.get('TENANT_ID', '[YOUR TENANT ID]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9331252fbf5362c6 — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:14

    'client_id': os.environ.get('CLIENT_ID', '[YOUR CLIENT ID]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44469581603649a6 — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:15

    'client_secret': os.environ.get('CLIENT_SECRET', '[YOUR CLIENT SECRET]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df452dd47602800c — Environment-variable access.

pkgs/python/[email protected]/samples/config.py:16

    'container_mh_id': os.environ.get('COSMOS_CONTAINER_MH', '[YOUR MH CONTAINER]'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #410b4cbe54332b15 — Environment-variable access.

pkgs/python/[email protected]/samples/diagnostics_filter_sample.py:10

endpoint = os.environ["ACCOUNT_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e88c9e2a86577b59 — Environment-variable access.

pkgs/python/[email protected]/samples/diagnostics_filter_sample.py:11

key = os.environ["ACCOUNT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc063f1f646034ae — Filesystem access.

pkgs/python/[email protected]/samples/document_management.py:349

    with open("file_name.txt", "r") as data_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64921372d2c33937 — Filesystem access.

pkgs/python/[email protected]/samples/document_management_async.py:361

    with open("file_name.txt", "r") as data_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72bc32e8250b2235 — Environment-variable access.

pkgs/python/[email protected]/samples/examples.py:17

url = os.environ["ACCOUNT_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e0f317cb85a788a — Environment-variable access.

pkgs/python/[email protected]/samples/examples.py:18

key = os.environ["ACCOUNT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05c013cf95e2607c — Environment-variable access.

pkgs/python/[email protected]/samples/examples_async.py:23

    url = os.environ["ACCOUNT_URI"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f0bbd214a8ff369 — Environment-variable access.

pkgs/python/[email protected]/samples/examples_async.py:24

    key = os.environ["ACCOUNT_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aaf7eea8c98c3eb1 — Environment-variable access.

pkgs/python/[email protected]/samples/tracing_open_telemetry.py:53

account_url = os.environ["COSMOS_ACCOUNT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23dd2dede12f74b7 — Environment-variable access.

pkgs/python/[email protected]/samples/tracing_open_telemetry.py:54

credential = os.environ["COSMOS_CREDENTIAL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22d2117645536e72 — Environment-variable access.

pkgs/python/[email protected]/samples/tracing_open_telemetry.py:55

database_name = os.environ["DATABASE_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44ca9fa00d166785 — Filesystem access.

pkgs/python/[email protected]/setup.py:24

with open(os.path.join(PACKAGE_FOLDER_PATH, '_version.py'), 'r') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ffee73c7a92d7a5 — Filesystem access.

pkgs/python/[email protected]/setup.py:31

with open("README.md", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #baeb4187897d375c — Filesystem access.

pkgs/python/[email protected]/setup.py:33

with open("CHANGELOG.md", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

azure-identity

python dependency

medium pii_flow dependency Excluded from app score #233b3cb833f04462 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:99 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/azure/identity/_credentials/environment.py:66 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/azure/identity/_credentials/environment.py:99

            _LOGGER.info("Environment is configured for %s", self._credential.__class__.__name__)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b17a5e6fed1205b7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:77 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:60 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:77

            _LOGGER.info("Environment is configured for %s", self._credential.__class__.__name__)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 105 low-confidence finding(s)

low env_fs dependency Excluded from app score #68362ad458503aad — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/app_service.py:22

    url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #407c96af8ae90a88 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/app_service.py:23

    secret = os.environ.get(EnvironmentVariables.IDENTITY_HEADER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a382ba43217231c0 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azd_cli.py:239

        path = os.environ.get("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e55961490d435e7f — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azd_cli.py:322

            "env": dict(os.environ, NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7febe6f02c306ac6 — Filesystem access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_arc.py:52

    with open(key_file, "r", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1c51855295b95f4 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_arc.py:74

        program_data_path = os.environ.get("PROGRAMDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e5d827e92bc898c — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_cli.py:240

        path = os.environ.get("SYSTEMROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #582505b873cb141b — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_cli.py:278

            "env": dict(os.environ, AZURE_CORE_NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50fbf25d5047efff — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_ml.py:23

    url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #edb9fbd8a6c97c9f — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_ml.py:24

    secret = os.environ.get(EnvironmentVariables.MSI_SECRET)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c54448ef63c5a7c2 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_pipelines.py:25

    base_uri = os.environ[SYSTEM_OIDCREQUESTURI].rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d79fb2132e5b26ce — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/azure_pipelines.py:37

    if SYSTEM_OIDCREQUESTURI not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c8d5d2b64202726 — Filesystem access.

pkgs/python/[email protected]/azure/identity/_credentials/certificate.py:149

        with open(certificate_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b2a192b21bfdf80 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/cloud_shell.py:34

        url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc7ef4d7ac1c29c1 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:154

            "interactive_browser_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3f31865c325f2bd — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:158

            "managed_identity_client_id", os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f528d81c9bc28e8c — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:162

            "workload_identity_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a562067c7191f7b8 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:166

        broker_tenant_id = kwargs.pop("broker_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #49529530948b115f — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:169

        shared_cache_username = kwargs.pop("shared_cache_username", os.environ.get(EnvironmentVariables.AZURE_USERNAME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c97268fa8cc8e63 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:171

            "shared_cache_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5155028b76d04d63 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:176

        token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a4b58364e2a3ee3 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/default.py:268

                        token_file_path=os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1091f4c9a76db662 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:63

        if all(os.environ.get(v) is not None for v in EnvironmentVariables.CLIENT_SECRET_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ce2ec55f7b792d3 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:65

                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5931b507576e3467 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:66

                client_secret=os.environ[EnvironmentVariables.AZURE_CLIENT_SECRET],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a5a817e0d1700ad — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:67

                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8061cfe0ef11cc38 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:70

        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.CERT_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #454da91e5506ef32 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:72

                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0728ba9e921386db — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:73

                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9510986d11d8154a — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:74

                certificate_path=os.environ[EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PATH],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30c97176107b5621 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:75

                password=os.environ.get(EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PASSWORD),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8c318f61c1f8e9c — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:77

                    os.environ.get(EnvironmentVariables.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6707e8e2c3ff073b — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:81

        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.USERNAME_PASSWORD_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5d585cd1ae5b51d — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:83

                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3e058ad9fc1a78c — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:84

                username=os.environ[EnvironmentVariables.AZURE_USERNAME],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2f1bf7820fb963e — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:85

                password=os.environ[EnvironmentVariables.AZURE_PASSWORD],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d72e18d38dc82ff2 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:86

                tenant_id=os.environ.get(EnvironmentVariables.AZURE_TENANT_ID),  # optional for username/password auth

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #983bbb607632a8a4 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/environment.py:106

            set_variables = [v for v in expected_variables if v in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #382ad6be1861cb67 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/imds.py:60

        os.environ.get(EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST, IMDS_AUTHORITY).strip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d419f6102de6c4a — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/imds.py:90

        if EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d3ebc6a8ebce45e — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:82

        if os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2cef63601f7f9dbd — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:83

            if os.environ.get(EnvironmentVariables.IDENTITY_HEADER):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f917b9914468095 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:84

                if os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e92dfbee2404f2e4 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:98

            elif os.environ.get(EnvironmentVariables.IMDS_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb095b88476881d3 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:103

        elif os.environ.get(EnvironmentVariables.MSI_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8d5bb36d218371a — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:104

            if os.environ.get(EnvironmentVariables.MSI_SECRET):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7dbadb9a41a49c26 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:115

            all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57a0edd15a84b44f — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:120

            workload_client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a1a9f10d836ea6c — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:131

                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bb38be1605c0012 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/managed_identity.py:133

                token_file_path=os.environ[EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d90668aa8dd57ce2 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:42

    url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68b9833c4eafd84e — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:43

    secret = os.environ.get(EnvironmentVariables.IDENTITY_HEADER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54124c5595e0776c — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/service_fabric.py:44

    thumbprint = os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #236dcc88ff0a4926 — Filesystem access.

pkgs/python/[email protected]/azure/identity/_credentials/vscode.py:50

            with open(expanded_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f50a930c92d4aca2 — Filesystem access.

pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:33

            with open(self._token_file_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac8a9db1abb1f1b9 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:79

        tenant_id = tenant_id or os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d30bac327aa61ffd — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:80

        client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6cf6f867fb3b7d85 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_credentials/workload_identity.py:81

        token_file_path = token_file_path or os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5790b9cd95d87a69 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_internal/msal_credentials.py:39

        self._regional_authority = os.environ.get(EnvironmentVariables.AZURE_REGIONAL_AUTHORITY_NAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89ae36b013921750 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_internal/utils.py:90

    authority = os.environ.get(EnvironmentVariables.AZURE_AUTHORITY_HOST, KnownAuthorities.AZURE_PUBLIC_CLOUD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f54f21e123b9c8a5 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_internal/utils.py:151

    if default_tenant == "adfs" or os.environ.get(EnvironmentVariables.AZURE_IDENTITY_DISABLE_MULTITENANTAUTH):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77ab31215ddbbc84 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_internal/utils.py:207

    token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #997e3f1a8322339b — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_persistent_cache.py:88

    if sys.platform.startswith("win") and "LOCALAPPDATA" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b49a04483f063ff — Environment-variable access.

pkgs/python/[email protected]/azure/identity/_persistent_cache.py:89

        cache_location = os.path.join(os.environ["LOCALAPPDATA"], ".IdentityService", cache_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c23378de54e2629 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/azd_cli.py:221

            env=dict(os.environ, NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06ff981dbacefffa — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_arc.py:19

        url = os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4207a7dcc873e03c — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_arc.py:20

        imds = os.environ.get(EnvironmentVariables.IMDS_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c07fccc65f826762 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/azure_cli.py:226

            env=dict(os.environ, AZURE_CORE_NO_COLOR="true"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e8ec94fae54a561 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/cloud_shell.py:21

        url = os.environ.get(EnvironmentVariables.MSI_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08f852350fc630e5 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:135

        shared_cache_username = kwargs.pop("shared_cache_username", os.environ.get(EnvironmentVariables.AZURE_USERNAME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #faebf95b912602a2 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:137

            "shared_cache_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2210298bfe70e059 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:141

            "managed_identity_client_id", os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fd89c7b149d51bc — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:145

            "workload_identity_tenant_id", os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5168297b4846140f — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:150

        token_credentials_env = os.environ.get(EnvironmentVariables.AZURE_TOKEN_CREDENTIALS, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac01aff1ac770223 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/default.py:231

                        token_file_path=os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9331b160ff124412 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:57

        if all(os.environ.get(v) is not None for v in EnvironmentVariables.CLIENT_SECRET_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #542bcb2589ce4746 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:59

                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1488e12f15c5179d — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:60

                client_secret=os.environ[EnvironmentVariables.AZURE_CLIENT_SECRET],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a6396afb79c509b — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:61

                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8786c5d37dbae1e0 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:64

        elif all(os.environ.get(v) is not None for v in EnvironmentVariables.CERT_VARS):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e5762c9fa21ea48 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:66

                client_id=os.environ[EnvironmentVariables.AZURE_CLIENT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a4f7e6966b03cbd — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:67

                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b989d455708a2764 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:68

                certificate_path=os.environ[EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PATH],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c56dade78bf927e — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:69

                password=os.environ.get(EnvironmentVariables.AZURE_CLIENT_CERTIFICATE_PASSWORD),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #780494fc90e51551 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:71

                    os.environ.get(EnvironmentVariables.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN, False)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c21fc525f7f3538 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/environment.py:80

            set_variables = [v for v in expected_variables if v in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab6e19cd885af24d — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/imds.py:54

        if EnvironmentVariables.AZURE_POD_IDENTITY_AUTHORITY_HOST in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3ab4821f2440b59 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:54

        if os.environ.get(EnvironmentVariables.IDENTITY_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f3a7203b4dac135 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:55

            if os.environ.get(EnvironmentVariables.IDENTITY_HEADER):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09437bc452c8162f — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:56

                if os.environ.get(EnvironmentVariables.IDENTITY_SERVER_THUMBPRINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce54263839468328 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:70

            elif os.environ.get(EnvironmentVariables.IMDS_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d82d109014e7c751 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:75

        elif os.environ.get(EnvironmentVariables.MSI_ENDPOINT):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9cd5ea40cf7b7170 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:76

            if os.environ.get(EnvironmentVariables.MSI_SECRET):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d79ba2127e992e91 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:87

            all(os.environ.get(var) for var in EnvironmentVariables.WORKLOAD_IDENTITY_VARS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77b21b2f069a256e — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:92

            workload_client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92669275e0cc4151 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:103

                tenant_id=os.environ[EnvironmentVariables.AZURE_TENANT_ID],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4368098fa76f1a5 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/managed_identity.py:105

                token_file_path=os.environ[EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b7415cd5102146b — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:57

        tenant_id = tenant_id or os.environ.get(EnvironmentVariables.AZURE_TENANT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa97e3a1aa773345 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:58

        client_id = client_id or os.environ.get(EnvironmentVariables.AZURE_CLIENT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e10f3b18398c9767 — Environment-variable access.

pkgs/python/[email protected]/azure/identity/aio/_credentials/workload_identity.py:59

        token_file_path = token_file_path or os.environ.get(EnvironmentVariables.AZURE_FEDERATED_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa88f12466204bf7 — Environment-variable access.

pkgs/python/[email protected]/samples/control_interactive_prompts.py:17

VAULT_URL = os.environ.get("VAULT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f4ac02ef15c6d3d — Environment-variable access.

pkgs/python/[email protected]/samples/credential_creation_code_snippets.py:360

        system_access_token=os.environ["SYSTEM_ACCESSTOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5660761c7163f01b — Environment-variable access.

pkgs/python/[email protected]/samples/credential_creation_code_snippets.py:374

        system_access_token=os.environ["SYSTEM_ACCESSTOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a653324f565d7a1c — Environment-variable access.

pkgs/python/[email protected]/samples/key_vault_cert.py:19

VAULT_URL = os.environ["VAULT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #196b0707237b0f39 — Environment-variable access.

pkgs/python/[email protected]/samples/user_authentication.py:14

VAULT_URL = os.environ.get("VAULT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ipykernel

python dependency

medium telemetry dependency Excluded from app score #3d865c76cd7e0a4c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/ipykernel/debugger.py:93

        self.tracker.track("thread1", pydevd_frame_utils.create_frames_list_from_frame(self.frame))

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #025ec4efc524b79c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/ipykernel/debugger.py:618

        self.variable_explorer.track()

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 28 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #feb4f33d12f78dc3 — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:78

with open(version_py) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aff59b860d6045fe — Environment-variable access.

pkgs/python/[email protected]/ipykernel/compiler.py:89

    cell_name = os.environ.get("IPYKERNEL_CELL_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04eb4e4649b710a8 — Filesystem access.

pkgs/python/[email protected]/ipykernel/connect.py:78

    with open(cf) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c7961b512a171f6 — Filesystem access.

pkgs/python/[email protected]/ipykernel/debugger.py:469

        with open(file_name, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da067f745710fc05 — Filesystem access.

pkgs/python/[email protected]/ipykernel/debugger.py:499

            with open(source_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5313d67d6cf90dd2 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:512

    qt_api = os.environ.get("QT_API", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0b02934cba9c146 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:546

                os.environ["QT_API"] = "pyqt5"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8eff17fee09ba17b — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:551

                    os.environ["QT_API"] = "pyside2"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55224b1edfcdc7f5 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:553

                    os.environ["QT_API"] = "pyqt5"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #551faa183bfb558f — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:558

                os.environ["QT_API"] = "pyqt6"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86de71332c130c76 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:563

                    os.environ["QT_API"] = "pyside6"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c764c5e56e024d47 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:565

                    os.environ["QT_API"] = "pyqt6"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28ca22ff4e6a62e6 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:568

            if "QT_API" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6176ca4375624fd7 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:569

                del os.environ["QT_API"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d42db8941813a6c0 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:579

        if "QT_API" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82a21e44ec0a09a6 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/eventloops.py:580

            del os.environ["QT_API"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0738c8c830e0e6a — Environment-variable access.

pkgs/python/[email protected]/ipykernel/iostream.py:563

                    and ("PYTEST_CURRENT_TEST" not in os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #759a222c440c1044 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/ipkernel.py:150

        jupyter_session_name = os.environ.get("JPY_SESSION_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae38017c1f41a91f — Environment-variable access.

pkgs/python/[email protected]/ipykernel/kernelapp.py:199

        int(os.environ.get("JPY_PARENT_PID") or 0),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb98d10b14cd8170 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/kernelapp.py:205

        int(os.environ.get("JPY_INTERRUPT_EVENT") or 0),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2967986349efc2b4 — Filesystem access.

pkgs/python/[email protected]/ipykernel/kernelapp.py:524

            blackhole = open(os.devnull, "w")  # noqa: SIM115

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c0ae0b14cd353f3 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/kernelapp.py:651

        if not os.environ.get("MPLBACKEND"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b032dd88fad89e5f — Environment-variable access.

pkgs/python/[email protected]/ipykernel/kernelapp.py:652

            os.environ["MPLBACKEND"] = "module://matplotlib_inline.backend_inline"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #608c1c4ff3b2439f — Filesystem access.

pkgs/python/[email protected]/ipykernel/kernelspec.py:103

    with open(pjoin(path, "kernel.json"), "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3bf618da932e0dac — Filesystem access.

pkgs/python/[email protected]/ipykernel/zmqshell.py:389

            with open(arg_s) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #729a0285581d03c1 — Environment-variable access.

pkgs/python/[email protected]/ipykernel/zmqshell.py:585

        env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f86b58abe2e61aa6 — Filesystem access.

pkgs/python/[email protected]/scripts/check_mypy_deps.py:26

    with open("pyproject.toml", "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fecdc547dcb4da14 — Filesystem access.

pkgs/python/[email protected]/scripts/check_mypy_deps.py:29

    with open(".pre-commit-config.yaml") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mcp

python dependency

medium pii_flow dependency Excluded from app score #3dd5bdb364672615 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.

pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:452 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:433 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/src/mcp/client/auth/oauth2.py:452

        return httpx.Request("POST", token_url, data=refresh_data, headers=headers)

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

expand_more 39 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #22ed63cd307c9f28 — Environment-variable access.

pkgs/python/[email protected]/.github/actions/conformance/client.py:72

    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #f0b637f3bed05bc3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/.github/actions/conformance/client.py:118

            response = await client.get(
                authorization_url,
                follow_redirects=False,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #a92028f70940677b — Environment-variable access.

pkgs/python/[email protected]/.github/actions/conformance/client.py:281

    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7877a6a002cd0286 — Environment-variable access.

pkgs/python/[email protected]/.github/actions/conformance/client.py:349

    scenario = os.environ.get("MCP_CONFORMANCE_SCENARIO")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #db24cae36cf2966f — Environment-variable access.

pkgs/python/[email protected]/examples/clients/conformance-auth-client/mcp_conformance_auth_client/__init__.py:50

    context_json = os.environ.get("MCP_CONFORMANCE_CONTEXT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #73005ca1b096c663 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/clients/conformance-auth-client/mcp_conformance_auth_client/__init__.py:113

            response = await client.get(
                authorization_url,
                follow_redirects=False,  # Don't follow redirects automatically
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #de350a6db2b0779b — Environment-variable access.

pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:343

    server_url = os.getenv("MCP_SERVER_PORT", 8000)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a2ae434755ba93c8 — Environment-variable access.

pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:344

    transport_type = os.getenv("MCP_TRANSPORT_TYPE", "streamable-http")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #56ab8236e4cda283 — Environment-variable access.

pkgs/python/[email protected]/examples/clients/simple-auth-client/mcp_simple_auth_client/main.py:345

    client_metadata_url = os.getenv("MCP_CLIENT_METADATA_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d196c1a85845aabe — Environment-variable access.

pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:24

        self.api_key = os.getenv("LLM_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d62e3cfd7bf5f0e5 — Filesystem access.

pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:45

        with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a46e897c9fe6235a — Environment-variable access.

pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:83

            env={**os.environ, **self.config["env"]} if self.config.get("env") else None,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #5ced1ec8b5ff19f9 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/clients/simple-chatbot/mcp_simple_chatbot/main.py:251

                response = client.post(url, headers=headers, json=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #34120217105b0dff — Filesystem access.

pkgs/python/[email protected]/examples/fastmcp/icons_demo.py:14

icon_data = base64.standard_b64encode(icon_path.read_bytes()).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2686e2dd2cd98032 — Environment-variable access.

pkgs/python/[email protected]/examples/fastmcp/memory.py:52

PROFILE_DIR = (Path.home() / ".fastmcp" / os.environ.get("USER", "anon") / "memory").resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #47180f31eaef2314 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/fastmcp/text_me.py:49

        response = client.post(
            "https://api.surgemsg.com/messages",
            headers={
                "Authorization": f"Bearer {surge_settings.api_key}",
                "Surge-Account": surge_settings.account_id,
                "Content-Type": "application/json",
            },
            json={
                "body": text_content,
                "conversation": {
                    "contact": {
                        "first_name": surge_settings.my_first_name,
                        "last_name": surge_settings.my_last_name,
                        "phone_number": surge_settings.my_phone_number,
                    }
                },
            },
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #0ebdd927089f5641 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/servers/simple-auth/mcp_simple_auth/token_verifier.py:53

                response = await client.post(
                    self.introspection_endpoint,
                    data={"token": token},
                    headers={"Content-Type": "application/x-www-form-urlencoded"},
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #fde51e8fead02d9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/servers/simple-tool/mcp_simple_tool/server.py:16

        response = await client.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #8cb7c1a933af3f54 — Environment-variable access.

pkgs/python/[email protected]/examples/snippets/clients/completion_client.py:17

    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #832a7ed45eea69e3 — Environment-variable access.

pkgs/python/[email protected]/examples/snippets/clients/display_utilities.py:17

    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #578b5a488687af69 — Environment-variable access.

pkgs/python/[email protected]/examples/snippets/clients/stdio_client.py:19

    env={"UV_INDEX": os.environ.get("UV_INDEX", "")},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cfbff559e18a926f — Filesystem access.

pkgs/python/[email protected]/examples/snippets/servers/binary_resources.py:9

    with open("logo.png", "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #064b257bb0b09493 — Filesystem access.

pkgs/python/[email protected]/examples/snippets/servers/embedded_resource_results.py:10

    with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c463d4a1902bd76c — Filesystem access.

pkgs/python/[email protected]/examples/snippets/servers/embedded_resource_results_binary.py:12

    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6f6f2b9e1a84aaac — Filesystem access.

pkgs/python/[email protected]/examples/snippets/servers/prompt_embedded_resources.py:11

    file_content = open(filename).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #72c31904ee2a384c — Filesystem access.

pkgs/python/[email protected]/examples/snippets/servers/tool_errors.py:27

    with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #528dfe3eea5a69e4 — Filesystem access.

pkgs/python/[email protected]/scripts/update_doc_snippets.py:53

        code = file.read_text().rstrip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d80ad9ad92669000 — Filesystem access.

pkgs/python/[email protected]/scripts/update_doc_snippets.py:109

    content = doc_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a0ac411ba512633f — Filesystem access.

pkgs/python/[email protected]/scripts/update_doc_snippets.py:134

            doc_path.write_text(updated_content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a978f0424d42399a — Environment-variable access.

pkgs/python/[email protected]/src/mcp/cli/claude.py:24

        path = Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config"), "Claude")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f0aa511d353f6fe — Filesystem access.

pkgs/python/[email protected]/src/mcp/cli/claude.py:77

            config_file.write_text("{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6372ecd554327e0f — Filesystem access.

pkgs/python/[email protected]/src/mcp/cli/claude.py:88

        config = json.loads(config_file.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f62870b475e0c780 — Filesystem access.

pkgs/python/[email protected]/src/mcp/cli/claude.py:135

        config_file.write_text(json.dumps(config, indent=2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1dd6f526a284cead — Environment-variable access.

pkgs/python/[email protected]/src/mcp/cli/cli.py:282

            env=dict(os.environ.items()),  # Convert to list of tuples for env update

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #a16a011f17d25ddb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/mcp/client/sse.py:138

                                    response = await client.post(
                                        endpoint_url,
                                        json=session_message.message.model_dump(
                                            by_alias=True,
                                            mode="json",
                                            exclude_none=True,
                                        ),
                                    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #794e13fb515b35f5 — Environment-variable access.

pkgs/python/[email protected]/src/mcp/client/stdio/__init__.py:59

        value = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #49434aac4a103088 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/mcp/server/fastmcp/resources/types.py:161

            response = await client.get(self.url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #16407ca196b7eff1 — Filesystem access.

pkgs/python/[email protected]/src/mcp/server/fastmcp/utilities/types.py:47

            with open(self.path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aeb21a6cbad8b82b — Filesystem access.

pkgs/python/[email protected]/src/mcp/server/fastmcp/utilities/types.py:94

            with open(self.path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

transformers

python dependency

medium pii_flow dependency Excluded from app score #2a386e677445d1d2 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514

            logger.debug(f"[Kubeflow] Token file not found: {token_path}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 399 low-confidence finding(s)

low env_fs dependency Excluded from app score #988da8c038065d66 — Filesystem access.

pkgs/python/[email protected]/setup.py:311

        with open(target, "w", encoding="utf-8", newline="\n") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab6dd10f1bfd4836 — Filesystem access.

pkgs/python/[email protected]/setup.py:331

        long_description=open("README.md", "r", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8013d52e7d210313 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/audio_utils.py:69

    response = httpx.get(url, follow_redirects=True, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #1607311fbe1dc8f7 — Filesystem access.

pkgs/python/[email protected]/src/transformers/audio_utils.py:339

            with open(audio, "rb") as audio_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #459b33e536a50f25 — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:176

    with open(file_name, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a19fbea0667f224 — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:182

    with open(file_name, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0655c71019d666ab — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:228

    autofile = (repo_path / "src" / "transformers" / "models" / "auto" / "auto_mappings.py").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e7de8a5a87b9209 — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:246

                file = (repo_path / "src" / "transformers" / "models" / "auto" / filename).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aec4ff94d861073f — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:333

    with open(toc_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c2ff839cd189c2f — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:392

    with open(module_name, "r", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91cf38f81f18cb92 — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:517

            with open(original_test_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd144fac0f8c178d — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:567

    with open(new_module_folder / f"modular_{new_lowercase_name}.py", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2bdde31c676499c — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:572

    with open(new_module_folder / "__init__.py", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6eb93fe2d88006aa — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:589

    with open(tests_folder / "__init__.py", "w"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05f71253c2aef793 — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:593

        with open(tests_folder / filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55ec73532d5b5745 — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/add_new_model_like.py:598

    with open(repo_path / "docs" / "source" / "en" / "model_doc" / f"{new_lowercase_name}.md", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #c7614f10b3006e2d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/cli/chat.py:212

        response = requests.post(f"{self.base_url.rstrip('/')}/load_model", json={"model": model}, stream=True)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #fcd2742e99216a4a — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/chat.py:363

            with open(examples_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #dc2b7425b995e68c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/cli/chat.py:379

            output = httpx.get(health_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ac576dbbd7ae9205 — Filesystem access.

pkgs/python/[email protected]/src/transformers/cli/chat.py:659

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aeab27b7f5217f28 — Filesystem access.

pkgs/python/[email protected]/src/transformers/configuration_utils.py:921

        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbae68951c2abe08 — Filesystem access.

pkgs/python/[email protected]/src/transformers/configuration_utils.py:1136

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #072141fd4f55d0f6 — Filesystem access.

pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:159

        with open(model, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8df94f8cdd33222 — Filesystem access.

pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:706

        with open(self.original_tokenizer.vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6261405f0b1291c1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:1713

        with open(vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a51bfe6455dd4ae0 — Filesystem access.

pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:1753

        with open(vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #193ae32d515dc1a7 — Filesystem access.

pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:1843

        with open(vocab_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fa90cc2b562c727 — Filesystem access.

pkgs/python/[email protected]/src/transformers/convert_slow_tokenizer.py:2003

        with open(self.vocab_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b0221f6bfe57936 — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:576

        with open(output_prediction_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bc3a5dbe5d5a5fc — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:580

        with open(output_nbest_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59d5356803ec9ff6 — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:584

        with open(output_null_log_odds_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d15741e1acf3618 — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:769

    with open(output_prediction_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80741bbda8e2f99e — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:772

    with open(output_nbest_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f6a7c535589b7e1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/metrics/squad_metrics.py:776

        with open(output_null_log_odds_file, "w") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #678c1ef876ec6eb2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/processors/squad.py:515

        with open(
            os.path.join(data_dir, self.train_file if filename is None else filename), "r", encoding="utf-8"
        ) as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #167042ab258ae2f8 — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/processors/squad.py:536

        with open(
            os.path.join(data_dir, self.dev_file if filename is None else filename), "r", encoding="utf-8"
        ) as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b9cfe9d31ed03ab — Filesystem access.

pkgs/python/[email protected]/src/transformers/data/processors/utils.py:119

        with open(input_file, "r", encoding="utf-8-sig") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1ee4c563708b7cd — Filesystem access.

pkgs/python/[email protected]/src/transformers/distributed/configuration_utils.py:86

        with open(json_file_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee768a46059fe13f — Environment-variable access.

pkgs/python/[email protected]/src/transformers/distributed/fsdp.py:48

        and strtobool(os.environ.get("ACCELERATE_USE_FSDP", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d44691f38b075e42 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/distributed/fsdp.py:49

        and strtobool(os.environ.get("FSDP_CPU_RAM_EFFICIENT_LOADING", "False")) == 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53fa5890165c59f1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:133

    with open(module_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a298ec3ce0ec3225 — Filesystem access.

pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:186

    with open(filename, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a7cefd1180d68ad — Filesystem access.

pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:298

        module_hash: str = hashlib.sha256(b"".join(bytes(f) + f.read_bytes() for f in module_files)).hexdigest()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44035a4a50b53acd — Filesystem access.

pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:341

        source_files_hash.update(file_path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e25b3aff3804762f — Filesystem access.

pkgs/python/[email protected]/src/transformers/dynamic_module_utils.py:813

        with open(requirements, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #564aea647c2be1cf — Filesystem access.

pkgs/python/[email protected]/src/transformers/feature_extraction_utils.py:611

        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90904588c481d83c — Filesystem access.

pkgs/python/[email protected]/src/transformers/feature_extraction_utils.py:639

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22615dc9ada9267b — Filesystem access.

pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1088

        with open(json_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ac8af3a9349a288 — Filesystem access.

pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1251

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d6b117cb42e175d — Filesystem access.

pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1372

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fcc7b69912bb8cb — Environment-variable access.

pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1818

        graph_mixing_supported = os.environ.get("NCCL_GRAPH_MIXING_SUPPORT", "1") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4aeacb6e652ecfea — Environment-variable access.

pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1819

        distributed = int(os.environ.get("WORLD_SIZE", "1")) > 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f35cb1671d695757 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/generation/configuration_utils.py:1824

            os.environ.setdefault("NCCL_GRAPH_MIXING_SUPPORT", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #118fb02f05ae39fc — Environment-variable access.

pkgs/python/[email protected]/src/transformers/generation/continuous_batching/distributed.py:160

        graph_mixing_not_disabled = os.environ.get("NCCL_GRAPH_MIXING_SUPPORT") != "0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cedcdd48904d4503 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/generation/utils.py:2177

            os.environ["TOKENIZERS_PARALLELISM"] = "0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #511e176517f14c31 — Filesystem access.

pkgs/python/[email protected]/src/transformers/hf_argparser.py:333

                    file_args += args_file.read_text().split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f5fb193245caf16 — Filesystem access.

pkgs/python/[email protected]/src/transformers/hf_argparser.py:403

        with open(Path(json_file), encoding="utf-8") as open_json_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c26c875530c8c21 — Filesystem access.

pkgs/python/[email protected]/src/transformers/hf_argparser.py:425

        outputs = self.parse_dict(yaml.safe_load(Path(yaml_file).read_text()), allow_extra_keys=allow_extra_keys)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #158595ce9d2cf5c1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/image_processing_base.py:417

        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93eda99fb5dc240c — Filesystem access.

pkgs/python/[email protected]/src/transformers/image_processing_base.py:445

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #0ff8e21676aa21e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/image_utils.py:486

            image = PIL.Image.open(BytesIO(httpx.get(image, timeout=timeout, follow_redirects=True).content))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6a61c0f46dcf60b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/image_utils.py:531

            raw = httpx.get(image, timeout=timeout, follow_redirects=True).content

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #02afee8885ae5237 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/accelerate.py:115

                local_rank = int(os.environ.get("LOCAL_RANK", 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #401dc78bba65cf18 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/deepgemm.py:88

    cuda_home = os.environ.get("CUDA_HOME") or os.environ.get("CUDA_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5bb998604451a13 — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/deepgemm.py:113

            with open(version_json) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c93f31d86d0c3071 — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/deepgemm.py:124

            with open(version_txt) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #199138a1c1250330 — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/deepgemm.py:135

            with open(cuda_h) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84674b41d2faa0e9 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/finegrained_fp8.py:258

        and os.environ.get("TRANSFORMERS_DISABLE_DEEPGEMM_LINEAR", "0") != "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #acead5d0a1aba261 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/hub_kernels.py:57

_TRANSFORMERS_USE_HUB_KERNELS = os.environ.get("USE_HUB_KERNELS", "YES").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dcfcb45f277a6cb9 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:40

if os.getenv("WANDB_MODE") == "offline":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f674ebcdd30477b — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:176

    if os.getenv("DISABLE_MLFLOW_INTEGRATION", "FALSE").upper() == "TRUE":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dadcb004f8e12085 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:212

    if os.getenv("DISABLE_KUBEFLOW_INTEGRATION", "FALSE").upper() == "TRUE":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ebe3a0e85512af8 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:214

    return os.getenv("KUBEFLOW_TRAINER_SERVER_URL") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68c273caf7be0180 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:436

    ray_scope = os.getenv("RAY_SCOPE", "last")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a86e970f0828e094 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:602

        self.logging_dir = os.getenv("TENSORBOARD_LOGGING_DIR", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11376d9ce963b1a7 — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:664

    with open(f"{output_dir}/model_architecture.txt", "w+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b584d12c6ae3fa9 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:709

        self._log_model = WandbLogModel(os.getenv("WANDB_LOG_MODEL", "false"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc0f713daa3ceaa4 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:763

                    project=os.getenv("WANDB_PROJECT", "huggingface"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d457f8936b7f927 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:775

            _watch_model = os.getenv("WANDB_WATCH", "false")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #108ce275f4d86c0a — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:815

                                fa.write(f.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14468fdcbc3f94c5 — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:878

                            fa.write(f.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03564e7bf21e031f — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1170

        log_assets = os.getenv("COMET_LOG_ASSETS", "FALSE").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #080fc30bc1900324 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1174

            comet_old_mode = os.getenv("COMET_MODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7072573273ef0461 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1334

        self._log_artifacts = os.getenv("HF_MLFLOW_LOG_ARTIFACTS", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #330aea5fba8956b6 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1335

        self._nested_run = os.getenv("MLFLOW_NESTED_RUN", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7302f2a280c5d642 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1336

        self._tracking_uri = os.getenv("MLFLOW_TRACKING_URI", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05629fdfa19d775e — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1337

        self._experiment_name = os.getenv("MLFLOW_EXPERIMENT_NAME", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57d3f5867a4b2df6 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1338

        self._flatten_params = os.getenv("MLFLOW_FLATTEN_PARAMS", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f373ac5fa2f1b640 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1339

        self._run_id = os.getenv("MLFLOW_RUN_ID", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3bd0ebabd48e793 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1340

        self._max_log_params = os.getenv("MLFLOW_MAX_LOG_PARAMS", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19ac3e49cb5bad7f — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1403

            mlflow_tags = os.getenv("MLFLOW_TAGS", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c78713327eef6522 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1487

        self.log_artifacts = os.getenv("HF_DAGSHUB_LOG_ARTIFACTS", "FALSE").upper() in ENV_VARS_TRUE_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97a6a6aad45e71c5 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1488

        self.name = os.getenv("HF_DAGSHUB_MODEL_NAME") or "main"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64f262e924e08f5b — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1489

        self.remote = os.getenv("MLFLOW_TRACKING_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72d7e4ee540e8522 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1493

            branch=os.getenv("BRANCH") or "main",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94cbdf4090d95887 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1908

                    self._log_model = os.getenv(
                        "CLEARML_LOG_MODEL",
                        "FALSE" if not ClearMLCallback._task_created_in_callback else "TRUE",
                    ).upper() in ENV_VARS_TRUE_VALUES.union({"TRUE"})

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #953d32ac84d1093a — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1915

                        project_name=os.getenv("CLEARML_PROJECT", "HuggingFace Transformers"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc65ca924135b37d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1916

                        task_name=os.getenv("CLEARML_TASK", "Trainer"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46b7877819c75ad8 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:1920

                    self._log_model = os.getenv("CLEARML_LOG_MODEL", "TRUE").upper() in ENV_VARS_TRUE_VALUES.union(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb868bf5e3a12fc9 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2189

            log_model_env = os.getenv("HF_DVCLIVE_LOG_MODEL", "FALSE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5717920617853e54 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2271

        self._log_model = os.getenv("SWANLAB_LOG_MODEL", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0f7871b4f74348b — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2342

            init_args["project"] = os.getenv("SWANLAB_PROJECT", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56eea32bfa06f3cb — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2344

            run_id = os.getenv("SWANLAB_RUN_ID", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a31ad3a09643132 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2348

            resume = os.getenv("SWANLAB_RESUME", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58f7749c1567667d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2494

        ca_file = os.environ.get(self._ENV_CA_CERT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64d94579801af30d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512

        token_path = os.environ.get(self._ENV_TOKEN_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79de9b9df59d1bbc — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2518

            with open(token_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb7a8f9783ee5e2f — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2534

            url = os.environ.get(self._ENV_SERVER_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #fe9a12d76d561bf6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2562

            with urllib.request.urlopen(req, timeout=5, context=self._get_ssl_context()) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ebb1f3019e3ff750 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/mxfp4.py:417

        rank = int(os.environ.get("LOCAL_RANK", "0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #684d38d1bf1733ad — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/npu_flash_attention.py:30

SPARSE_MODE = int(os.getenv("NPU_FA2_SPARSE_MODE", default=DOWN_RIGHT_ALIGNED_CAUSAL_MASK_MODE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4787f93ee1ac46e — Filesystem access.

pkgs/python/[email protected]/src/transformers/integrations/peft.py:708

        with open(_adapter_model_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c08fc1d4958e042d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:77

                rank = int(os.environ["RANK"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f32c17fcc152371 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:78

                local_rank = int(os.environ["LOCAL_RANK"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46bfe25cbd900e9e — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:79

                world_size = int(os.environ["WORLD_SIZE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4916c473086d61d4 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:103

            current_device.set_device(int(os.environ["LOCAL_RANK"]))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95f598cdff5b97de — Environment-variable access.

pkgs/python/[email protected]/src/transformers/integrations/tensor_parallel.py:122

        device_map = torch.device(f"{device_mesh.device_type}:{int(os.environ['LOCAL_RANK'])}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c69a42be92634e8c — Filesystem access.

pkgs/python/[email protected]/src/transformers/model_debugging_utils.py:243

    with open(full_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a78b46ffa7c8190 — Filesystem access.

pkgs/python/[email protected]/src/transformers/model_debugging_utils.py:266

    with open(summary_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #342b105011ad36b8 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/modeling_flash_attention_utils.py:657

            deterministic if deterministic is not None else os.getenv("FLASH_ATTENTION_DETERMINISTIC", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b35d889f27f8e65e — Environment-variable access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:163

XLA_USE_BF16 = os.environ.get("XLA_USE_BF16", "0").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8eab321da84f2a74 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:164

XLA_DOWNCAST_BF16 = os.environ.get("XLA_DOWNCAST_BF16", "0").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e46e52678ddedb35 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:213

    return _is_torch_distributed_initialized() and int(os.environ.get("LOCAL_RANK", "-1")) == 0

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c601b40aded61245 — Filesystem access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:323

        with open("/proc/mounts", encoding="utf-8") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43b84b84a65e808f — Filesystem access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:356

            with open(checkpoint_path, "rb") as _fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de6a0af18287f6dc — Filesystem access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:3705

            with open(save_index_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #035e82f540db682c — Environment-variable access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:4268

        if device_map == "auto" and int(os.environ.get("WORLD_SIZE", "0")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0fb616d7e146c23 — Filesystem access.

pkgs/python/[email protected]/src/transformers/modeling_utils.py:4570

                        with open(file, "rb") as _fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #011ec405aa0ece4c — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/auto/auto_factory.py:311

                with open(maybe_adapter_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f96b4320f2958c1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/auto/processing_auto.py:274

                with open(tokenizer_config_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a28a5b738df0089 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/auto/tokenization_auto.py:435

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5318289c00abb026 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/auto/tokenization_auto.py:442

    with open(merges_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cbbd4c61906b8d2f — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/auto/tokenization_auto.py:613

    with open(resolved_config_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43a3490985dba7ba — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bark/processing_bark.py:101

                with open(speaker_embeddings_path) as speaker_embeddings_json:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a09b64805ac662a — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bark/processing_bark.py:161

            with open(os.path.join(save_directory, speaker_embeddings_dict_path), "w") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44af84f1c71df6ae — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bartpho/tokenization_bartpho.py:133

        with open(monolingual_vocab_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e3e9deb800ecba5 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bartpho/tokenization_bartpho.py:306

            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a07033599d04938d — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bartpho/tokenization_bartpho.py:315

            with open(out_monolingual_vocab_file, "w", encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39e1521da9025550 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bert/tokenization_bert.py:33

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed756ddd31a68617 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bert/tokenization_bert_legacy.py:32

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d14e4f2def17e64 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bert/tokenization_bert_legacy.py:245

        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dfcfec4d7f9ab02 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bert_japanese/tokenization_bert_japanese.py:41

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b4b17ccdb6d2bd3 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bert_japanese/tokenization_bert_japanese.py:278

            with open(vocab_file, "wb") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74a0d78cc07ce6ff — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bert_japanese/tokenization_bert_japanese.py:282

            with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bf28271465d7247 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:142

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e16b61834ff66210 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:316

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8793a7833c78ca7a — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:324

        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bc9672ff0c500a8 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/bertweet/tokenization_bertweet.py:338

                with open(f, "r", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfaf03292e0ca3f7 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:116

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf9e752692f65777 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:119

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2d11c00813f50b3 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:293

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b879dbe98526e0c6 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/biogpt/tokenization_biogpt.py:297

        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #945ddeacd5d251b4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:89

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ccb3683c2053b20 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:92

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ef45ecbfadd5db2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:203

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #932925f6638053ae — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/blenderbot_small/tokenization_blenderbot_small.py:207

        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dcbe286f590501c8 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/clvp/tokenization_clvp.py:149

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #599574a91acbaabb — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/clvp/tokenization_clvp.py:155

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f605cc9b18d9972a — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/cpm/tokenization_cpm.py:324

            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c8835222564d009 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/cpmant/tokenization_cpmant.py:37

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51befaa687f64590 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/cpmant/tokenization_cpmant.py:219

        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6cb1a4b5efcffd43 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/ctrl/tokenization_ctrl.py:128

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b7e292a2a1757d0 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/ctrl/tokenization_ctrl.py:131

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb90c950a7be4a85 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/esm/openfold_utils/residue_constants.py:417

    stereo_chemical_props = resources.read_text("openfold.resources", "stereo_chemical_props.txt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ccf2299dbadd912 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/esm/tokenization_esm.py:28

    with open(vocab_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f99d83c8bcda161 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/esm/tokenization_esm.py:136

        with open(vocab_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #225b072b330d9857 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fastspeech2_conformer/tokenization_fastspeech2_conformer.py:65

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2566c69dc6e840d9 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fastspeech2_conformer/tokenization_fastspeech2_conformer.py:163

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff437c2067b1ccd0 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:237

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a05545bbd1275fa1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:240

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a8af9d01c8075a4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:498

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8bb19c4c2c2c48e — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/flaubert/tokenization_flaubert.py:502

        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #031afdc0507ba5b5 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:204

        with open(src_vocab_file, encoding="utf-8") as src_vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ccb7173759d3d5f — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:206

        with open(tgt_vocab_file, encoding="utf-8") as tgt_vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #644a6e9e14fe53d2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:209

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64ec47a169cd0590 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:446

        with open(src_vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd5adcbb9db35d9a — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:449

        with open(tgt_vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7a01694c553dfdc — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/fsmt/tokenization_fsmt.py:454

        with open(merges_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2de5a600103ea889 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:35

    with open(emoji_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e2f3a20ab6fdcbf — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:41

    with open(vocab_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ca27aeb7f703cfc — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:180

        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19256ac55383a0c2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/gpt_neox_japanese/tokenization_gpt_neox_japanese.py:190

        with open(emoji_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb3fc3bcd6c6c1bb — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/luke/tokenization_luke.py:287

            with open(entity_vocab_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08c386c9785e73f6 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/m2m_100/tokenization_m2m_100.py:311

            with open(spm_save_path, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7feecd6620274185 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/m2m_100/tokenization_m2m_100.py:375

    with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4a45ed9c104f426 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/m2m_100/tokenization_m2m_100.py:380

    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41bddc1ac0c8bec7 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/marian/tokenization_marian.py:352

                with open(spm_save_path, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bc5141cf689d491 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/marian/tokenization_marian.py:416

    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea6eed1cf47e7b26 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/marian/tokenization_marian.py:421

    with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a6ede2a34b78814 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/megatron_gpt2/checkpoint_reshaping_and_interoperability.py:598

        with open(save_index_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76d499ab8120f2ab — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/megatron_gpt2/checkpoint_reshaping_and_interoperability.py:651

    with open(tracker_filepath, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2f63a7ab1de3762 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/mgp_str/tokenization_mgp_str.py:53

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87b02ccc306b3838 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/mgp_str/tokenization_mgp_str.py:97

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f964878998369b1c — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/mluke/tokenization_mluke.py:308

            with open(entity_vocab_file, encoding="utf-8") as entity_vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75e40daba5862be2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/mluke/tokenization_mluke.py:1713

        with open(entity_vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2fcf3e1880ce0c1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/myt5/tokenization_myt5.py:46

            with open(rewriting_rules, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8fe9ddea5a2634b7 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/myt5/tokenization_myt5.py:195

        self.byte_maps = json.load(open(vocab_file, "r"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #258640dda51396fc — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/myt5/tokenization_myt5.py:373

        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ff6e66836b64b2c — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/oneformer/image_processing_oneformer.py:95

    with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21c91258d6b8dff9 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/oneformer/image_processing_pil_oneformer.py:241

    with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fde0c00790618ad8 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/phobert/tokenization_phobert.py:126

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e79470d0b973ad11 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/phobert/tokenization_phobert.py:310

            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cca89ea06f169fe — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/phobert/tokenization_phobert.py:331

                with open(f, "r", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51b54183d99418c5 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/pop2piano/tokenization_pop2piano.py:111

        with open(vocab, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f6c357452f15dc2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/pop2piano/tokenization_pop2piano.py:358

        with open(out_vocab_file, "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a52d4a5166deb4b4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/prophetnet/tokenization_prophetnet.py:259

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62064881ec57e9e3 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/prophetnet/tokenization_prophetnet.py:438

        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2007cdcab8ed838 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:134

        if not strtobool(os.environ.get("TRUST_REMOTE_CODE", "False")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fa38b6b554599d6 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:141

        with open(passages_path, "rb") as passages_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d6e3dd08acbbbc4 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:150

        if not strtobool(os.environ.get("TRUST_REMOTE_CODE", "False")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #994b2af65b4dbf6f — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/rag/retrieval_rag.py:157

        with open(resolved_meta_path, "rb") as metadata_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d10e2eec3831810 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:52

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ed1eef95d66c6f5 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:139

        with open(word_shape_file, "r", encoding="utf8") as in_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff58b882e3040c34 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:142

        with open(word_pronunciation_file, "r", encoding="utf8") as in_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea22a8f598691c17 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:1077

        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c612db8f066c5528 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:1088

        with open(word_shape_file, "w", encoding="utf8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #160ec150e2cdb0ad — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/roc_bert/tokenization_roc_bert.py:1091

        with open(word_pronunciation_file, "w", encoding="utf8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d8f18adab6d47ed — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/siglip/tokenization_siglip.py:345

            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f527b8b8653f1f9e — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/speech_to_text/tokenization_speech_to_text.py:271

            with open(spm_save_path, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2cbf435976c8ebb — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/speech_to_text/tokenization_speech_to_text.py:285

    with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b97d73b7d12a9edd — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/speech_to_text/tokenization_speech_to_text.py:290

    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98d35f5001b4502f — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/splinter/tokenization_splinter.py:33

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f66dd4c0cad1687 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/tapas/tokenization_tapas.py:91

    with open(vocab_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03a8cf41769db05c — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/tapas/tokenization_tapas.py:394

        with open(vocab_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96e4910c88a9852e — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/vits/tokenization_vits.py:83

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c467af3082950fa — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/vits/tokenization_vits.py:242

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12d4bc9191dd1e9e — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/wav2vec2/tokenization_wav2vec2.py:154

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96fd890ed2e81740 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/wav2vec2/tokenization_wav2vec2.py:647

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bffa11fe02fc4dad — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/wav2vec2_phoneme/tokenization_wav2vec2_phoneme.py:138

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bcaa2efd8ab857b — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/wav2vec2_phoneme/tokenization_wav2vec2_phoneme.py:575

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87721cc45d276e05 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:266

            with open(normalizer_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e69ab965b5ab3c9 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:560

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f821543f2e4426fa — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:563

        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ce96bfdc5742ec5 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/whisper/tokenization_whisper.py:568

            with open(normalizer_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa5a1d623556ba11 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:244

        with open(vocab_file, encoding="utf-8") as vocab_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cc601c70956e4cb — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:247

        with open(merges_file, encoding="utf-8") as merges_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43973894609ab1c1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:541

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc949ea6ebc1d785 — Filesystem access.

pkgs/python/[email protected]/src/transformers/models/xlm/tokenization_xlm.py:545

        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d98ad4c6533debb0 — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/__init__.py:921

                with open(maybe_adapter_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #614e94b011a3dbca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/pipelines/audio_classification.py:172

                inputs = httpx.get(inputs, follow_redirects=True).content

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2a6b1c9537ac2993 — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/audio_classification.py:174

                with open(inputs, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #11184f1d17d0ba0a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/pipelines/automatic_speech_recognition.py:350

                inputs = httpx.get(inputs, follow_redirects=True).content

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #190f2448a97e862d — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/automatic_speech_recognition.py:352

                with open(inputs, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88bf40848ac1b39c — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:464

        with open(binary_path, "wb+") as f_output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd42da8f7dc48488 — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:527

        with open(self.input_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e00946b9ffaf4e47 — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:542

        with open(self.output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #508cab25dda105a7 — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:570

        with open(input_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cad4a409f607912d — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:587

        with open(self.output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e69204edf4415d51 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:1200

        if "TOKENIZERS_PARALLELISM" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20c49104a74429ea — Environment-variable access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:1202

            os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ca3c53c1046b742 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:1321

        if "TOKENIZERS_PARALLELISM" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1410a0fb8cc22b41 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/pipelines/base.py:1323

            os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #274d4fc8ea29a325 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/pipelines/video_classification.py:154

                video = BytesIO(httpx.get(video, follow_redirects=True).content)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f6c7642f3510975b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/pipelines/zero_shot_audio_classification.py:109

                audio = httpx.get(audio, follow_redirects=True).content

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #47def973db2fb905 — Filesystem access.

pkgs/python/[email protected]/src/transformers/pipelines/zero_shot_audio_classification.py:111

                with open(audio, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9f2e954a4ca61e4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1090

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df8265d7eaf3abac — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1170

            with open(output_chat_template_file_jinja, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c76792b44707cbe4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1178

                    with open(output_chat_template_file_jinja, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f9d5dc699f92cec — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1187

                    with open(template_filepath, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #985d300ed33b348e — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1375

            with open(resolved_chat_template_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89c6249100eb99a4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1387

                template_name: open(template_file, "r", encoding="utf-8").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59cfc449c99d436f — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1391

                with open(resolved_raw_chat_template_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47525fe3cb97d102 — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1406

                with open(resolved_processor_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c4a66b5a78dd1ee — Filesystem access.

pkgs/python/[email protected]/src/transformers/processing_utils.py:1432

                reader = open(resolved_audio_tokenizer_file, "r", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #7a3c4655a6d20464 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/safetensors_conversion.py:48

    result = httpx.post(sse_url, follow_redirects=True, json=data).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #cb931c33d32a07eb — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:290

        value = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb47133c46df537b — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:306

        value = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc03ddd3a76f9547 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:1079

    if "TRANSFORMERS_TEST_BACKEND" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3372640c8b788964 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:1080

        backend = os.environ["TRANSFORMERS_TEST_BACKEND"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f03a398d02c0772 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:1089

    if "TRANSFORMERS_TEST_DEVICE" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3870d332e4dc836e — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:1090

        torch_device = os.environ["TRANSFORMERS_TEST_DEVICE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4aa666c48d45e685 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2161

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f8918a5c66b9817 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2283

            for k in list(os.environ.keys()):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1780e87865a9b2ca — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2285

                    del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c55f625cd32dd1d9 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2296

    return mock.patch.dict(os.environ, kwargs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c15f151c7da74e8c — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2311

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8fe17e6171c6a4f — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2413

        with open(report_files["durations"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7dae84e6009aed21 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2443

    with open(report_files["failures_long"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2e371b16686ad20 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2448

    with open(report_files["failures_short"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f96e15c766cda54c — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2453

    with open(report_files["failures_line"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a95e1660a2804bc — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2457

    with open(report_files["errors"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aabcc33fa5fa0248 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2461

    with open(report_files["warnings"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3259cf933cdad2a9 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2475

    with open(report_files["summary_short"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b0e16e76038d539 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2479

    with open(report_files["stats"], "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29199361ceadb5ce — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2579

    worker = os.environ.get("PYTEST_XDIST_WORKER", "gw0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d149857597577368 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2626

    with open(file_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff43b0e74ad8ee0b — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2828

        timeout = int(os.environ.get("PYTEST_TIMEOUT", "600"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff6d80d188c1a728 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2864

        if os.getenv("_INSIDE_SUB_PROCESS", None) == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ec77dd04583d280 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2867

            test = " ".join(os.environ.get("PYTEST_CURRENT_TEST").split(" ")[:-1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35a4c27db3080316 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2869

                env = copy.deepcopy(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76576e50c7a06e0a — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:2986

    skip_cuda_tests: bool = os.environ.get("SKIP_CUDA_DOCTEST", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c51ea556a90ad98 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3224

    if "TRANSFORMERS_TEST_DEVICE_SPEC" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00cd3a2fcf5010d7 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3225

        device_spec_path = os.environ["TRANSFORMERS_TEST_DEVICE_SPEC"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a52f2335bb6c045 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3248

        if "TRANSFORMERS_TEST_DEVICE" in os.environ and torch_device != device_name:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5148ef7614a4e37d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3449

    force_fullgraph = os.environ.get("TORCH_COMPILE_FORCE_FULLGRAPH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18498e3b50f47959 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3472

    full_test_name = os.environ.get("PYTEST_CURRENT_TEST", "").split(" ")[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d361435236f67dd — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3552

    with open(actual_test_file) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b02a624a120988e — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3558

    with open(caller_path) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e80aa7a79dbdccf — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3646

    p = os.path.join(os.environ.get("_PATCHED_TESTING_METHODS_OUTPUT_DIR", ""), "captured_info.txt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ee28b95aa349453 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3648

    with open(p, "a") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1419f46bcb888869 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3765

        if not os.environ.get("PYTEST_CURRENT_TEST", ""):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90b0505dc798ad01 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3802

            if os.getenv("CI") == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bfbe7ebeb686f0b7 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:3878

    p = os.path.join(os.environ.get("_PATCHED_TESTING_METHODS_OUTPUT_DIR", ""), "captured_info.txt")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91a726a0b827d804 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:4232

    with open(file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1607db32adef89a — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:4237

    with open(file, "r") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f938f53c1fb9946b — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:4473

            with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41312d20ab193e05 — Filesystem access.

pkgs/python/[email protected]/src/transformers/testing_utils.py:4482

            with open(new_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33c33f3fd10d4c4f — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_python.py:1397

        with open(vocab_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9023b82d0e149d77 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_python.py:1406

        with open(merge_file, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc4617e33000cedc — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1661

                    with open(resolved_config_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a375b34dc7280805 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1780

            with open(tokenizer_config_file, encoding="utf-8") as tokenizer_config_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c11e8d51ed3f75f5 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1799

            with open(chat_template_file, encoding="utf-8") as chat_template_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64ef6e52a2b30396 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1806

            with open(template_file) as chat_template_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88d0becaec841654 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1875

                with open(special_tokens_map_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c0e409022969008 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1905

                with open(added_tokens_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d7bdf76059c566c — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:1918

                with open(tokenizer_file, encoding="utf-8") as tokenizer_file_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dc88a5756197a7c — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:2123

        with open(tokenizer_config_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbe816b5ed931846 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:2176

            with open(added_tokens_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #01a0d59d20dc92f9 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3314

            with open(chat_template_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3611dae30238fc39 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3325

                    with open(chat_template_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20adf52e5e1c5d6b — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3335

                    with open(template_filepath, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b74ff35303b56fb — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3608

            with open(resolved_vocab_file, "r", encoding="utf-8") as vf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6c195b104c11800 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3634

                with open(resolved_vocab_txt, "r", encoding="utf-8") as vf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6ea68200a670748 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_base.py:3660

            with open(resolved_merges_file, "r", encoding="utf-8") as mf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dce0bc9d5c997ed4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_sentencepiece.py:260

            with open(out_vocab_file, "wb") as fi:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c7ccea521a9747c — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_tokenizers.py:121

            with open(fast_tokenizer_file, encoding="utf-8") as tokenizer_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #651056735e3e29e1 — Filesystem access.

pkgs/python/[email protected]/src/transformers/tokenization_utils_tokenizers.py:1335

                with open(_config_file, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbeef5706d7d3da8 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/trainer.py:2465

                model, device_ids=[int(os.getenv("SMDATAPARALLEL_LOCAL_RANK"))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92b97d1de09837a9 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer.py:4021

        with open(model_card_filepath, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e53d0028bcb57bfb — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer.py:4126

                with open(index_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab40e8f30b2eedc4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer_callback.py:146

        with open(json_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb1df2206bf82a72 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer_callback.py:152

        with open(json_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ab8f729f2d9e274 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer_jit_checkpoint.py:60

            with open(sentinel_file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #34fcb1e42ac76ce4 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer_pt_utils.py:943

    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccc6c3a927218f07 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer_pt_utils.py:949

            with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #491ba74c9f28a726 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer_pt_utils.py:955

        with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b41b6c7784fa37a4 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/trainer_utils.py:166

        os.environ["CUDA_LAUNCH_BLOCKING"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8bcacf6b8860c413 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/trainer_utils.py:167

        os.environ["CUBLAS_WORKSPACE_CONFIG"] = ":16:8"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26e085cc7c2e2906 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/trainer_utils.py:169

        os.environ["ASCEND_LAUNCH_BLOCKING"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #288abe2c5c35e87d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/trainer_utils.py:170

        os.environ["HCCL_DETERMINISTIC"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1e808935f194a5f — Environment-variable access.

pkgs/python/[email protected]/src/transformers/trainer_utils.py:172

        os.environ["FLASH_ATTENTION_DETERMINISTIC"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7275f6ce5b0a4f2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/trainer_utils.py:1094

    with open(load_index, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a59ed16bde6e610 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:86

    if os.environ.get("TORCHELASTIC_RUN_ID"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95d0b7d3dec627c7 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1556

        self.mixed_precision = os.environ.get("ACCELERATE_MIXED_PRECISION", "no")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e055f892482d8c4b — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1576

                os.environ["ACCELERATE_DYNAMO_BACKEND"] = self.torch_compile_backend

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa50c1fc4f0dfbbe — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1578

                    os.environ["ACCELERATE_DYNAMO_MODE"] = self.torch_compile_mode

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4608eeb0aabb0271 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1650

        elif strtobool(os.environ.get("ACCELERATE_USE_DEEPSPEED", "false")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #113e311355b066fa — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1810

        if self.use_cpu or strtobool(os.environ.get("ACCELERATE_USE_CPU", "False")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f417b5f07bad005 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1834

                os.environ["ACCELERATE_USE_DEEPSPEED"] = "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d94fb2e3c7de0020 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1837

                del os.environ["ACCELERATE_USE_DEEPSPEED"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bef1b33a98a22eaf — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:1880

                    "cuda:0" if torch.cuda.is_available() else os.environ.get("ACCELERATE_TORCH_DEVICE", "cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e26d6e25c788df4f — Filesystem access.

pkgs/python/[email protected]/src/transformers/training_args.py:2699

            with open(self.fsdp_config, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab9a8b8a4aba19ba — Environment-variable access.

pkgs/python/[email protected]/src/transformers/training_args.py:2766

        os.environ["FSDP_CPU_RAM_EFFICIENT_LOADING"] = cpu_ram_efficient_loading

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #48e1fd9f272c2e6b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/utils/attention_visualizer.py:183

            img = Image.open(io.BytesIO(httpx.get(img, follow_redirects=True).content))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #03b90cbbb8675722 — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/generic.py:379

        with open(json_file, encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7bf2ad0706e1529 — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/generic.py:862

        with open(pretrained_model_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0523a5e84ca3d370 — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/generic.py:868

        with open(os.path.join(pretrained_model_path, "config.json")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1398354a964825f8 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:107

HF_MODULES_CACHE = os.getenv("HF_MODULES_CACHE", os.path.join(constants.HF_HOME, "modules"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #f13f776486b33b79 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/utils/hub.py:178

        instance_data = httpx.get(os.environ["ECS_CONTAINER_METADATA_URI"]).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #6da986c310afabce — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:178

        instance_data = httpx.get(os.environ["ECS_CONTAINER_METADATA_URI"]).json()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e6700716cff7717 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:185

    sagemaker_params = json.loads(os.getenv("SM_FRAMEWORK_PARAMS", "{}"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c37205af34ab114d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:187

    training_job_arn = os.getenv("TRAINING_JOB_ARN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ede3ec7b7acff9ec — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:191

        "sm_framework": os.getenv("SM_FRAMEWORK_MODULE", None),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25557efd15d553b8 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:192

        "sm_region": os.getenv("AWS_REGION", None),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cabd95572c87afc — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:193

        "sm_number_gpu": os.getenv("SM_NUM_GPUS", "0"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa4c57581ced8f89 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:194

        "sm_number_cpu": os.getenv("SM_NUM_CPUS", "0"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bdaf6608604b172b — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:215

    if os.environ.get("TRANSFORMERS_IS_CI", "").upper() in ENV_VARS_TRUE_VALUES:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf482e5228d0987a — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/hub.py:879

    with open(index_filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c6d1c7217bf59be — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:118

    return os.getenv(env_variable, "false").lower() in ("true", "1", "y", "yes", "on")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #60cf7333bf814688 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:123

    return os.getenv(env_variable, "true").lower() in ("false", "0", "n", "no", "off")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #307cdd2b90f41ac3 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:130

USE_TORCH_XLA = os.environ.get("USE_TORCH_XLA", "1").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e1085993135ed83 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:356

    pytorch_cndev_based_mlu_check_previous_value = os.environ.get("PYTORCH_CNDEV_BASED_MLU_CHECK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #964ced2d4db46924 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:358

        os.environ["PYTORCH_CNDEV_BASED_MLU_CHECK"] = str(1)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e7367dd64933c96 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:362

            os.environ["PYTORCH_CNDEV_BASED_MLU_CHECK"] = pytorch_cndev_based_mlu_check_previous_value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bd4d53f60f798c4 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:364

            os.environ.pop("PYTORCH_CNDEV_BASED_MLU_CHECK", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6734fd0a0559d75 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:434

    if os.environ.get("PT_HPU_LAZY_MODE", "1") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ec39e6278c79ebd — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1640

    if os.getenv("TRANSFORMERS_DISABLE_TORCH_CHECK", "0") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6244f7b880a3095d — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1689

        if "DATABRICKS_RUNTIME_VERSION" in os.environ and os.environ["DATABRICKS_RUNTIME_VERSION"] < "11.0":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b63324040b8a1278 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1701

    sagemaker_params = os.getenv("SM_FRAMEWORK_PARAMS", "{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22518c22a86cf132 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1715

    smp_options = os.getenv("SM_HP_MP_PARAMETERS", "{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ce08e031499ef0c — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1725

    mpi_options = os.getenv("SM_FRAMEWORK_PARAMS", "{}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #531a6febef844280 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:1738

    return "SAGEMAKER_JOB_NAME" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5d158146d723798 — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/import_utils.py:2850

        with open(os.path.join(module_path, module_name), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e369c7487a30595 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/logging.py:64

    env_level_str = os.getenv("TRANSFORMERS_VERBOSITY", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec875380ea5a38fe — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/logging.py:94

            sys.stderr = open(os.devnull, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea020aa3e5da4439 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/logging.py:108

        if os.getenv("TRANSFORMERS_VERBOSITY", None) == "detail":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #337db745f58aef72 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/logging.py:114

        ci = os.getenv("CI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd5a619372828a49 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/logging.py:322

    no_advisory_warnings = os.getenv("TRANSFORMERS_NO_ADVISORY_WARNINGS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #528c5c62a6cd02e2 — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/network_logging.py:172

        Path(dump_path).write_text(json.dumps(records), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fc972c93a34bf12 — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/network_logging.py:182

                records = json.loads(Path(record_file).read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9f242feb041ab8b — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/network_logging.py:327

        report_path.write_text(json.dumps(self.build_report(), indent=2, sort_keys=True), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #01bd32a34cb3fb5c — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/network_logging.py:338

    enabled_raw = os.environ.get("NETWORK_DEBUG_REPORT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cab099be2f6b5955 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/network_logging.py:344

    output_path = os.environ.get("NETWORK_DEBUG_REPORT_PATH", "").strip() or _DEFAULT_REPORT_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a96baadb10a2f28 — Environment-variable access.

pkgs/python/[email protected]/src/transformers/utils/notebook.py:128

        if "VSCODE_PID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aadd92b31e425c03 — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/pytest_helpers.py:39

    data = json.loads(p.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #086718173878c67e — Filesystem access.

pkgs/python/[email protected]/src/transformers/utils/quantization_config.py:144

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff992f4f46c45e4c — Filesystem access.

pkgs/python/[email protected]/src/transformers/video_processing_utils.py:769

        with open(json_file_path, "w", encoding="utf-8") as writer:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0684cbcaf8487b5a — Filesystem access.

pkgs/python/[email protected]/src/transformers/video_processing_utils.py:789

        with open(json_file, "r", encoding="utf-8") as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #7e5887288072ae6d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/transformers/video_utils.py:701

        file_obj = BytesIO(httpx.get(video, follow_redirects=True).content)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

aiohttp

python dependency

expand_more 30 low-confidence finding(s)

low env_fs dependency Excluded from app score #31971f3cb05be399 — Filesystem access.

pkgs/python/[email protected]/aiohttp/cookiejar.py:207

        with open(
            file_path,
            mode="w",
            encoding="utf-8",
            opener=lambda path, flags: os.open(path, flags, 0o600),
        ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a93d2e5f932e64a6 — Environment-variable access.

pkgs/python/[email protected]/aiohttp/helpers.py:73

NO_EXTENSIONS = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #402b88556109171d — Environment-variable access.

pkgs/python/[email protected]/aiohttp/helpers.py:82

    not sys.flags.ignore_environment and bool(os.environ.get("PYTHONASYNCIODEBUG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f3ede160cf87a59 — Environment-variable access.

pkgs/python/[email protected]/aiohttp/helpers.py:228

    netrc_env = os.environ.get("NETRC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #4286690440a280aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/aiohttp/test_utils.py:347

        resp = await self._session.request(method, self.make_url(path), **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ddd780a0205d1bfe — Environment-variable access.

pkgs/python/[email protected]/aiohttp/web_fileresponse.py:50

NOSENDFILE: Final[bool] = bool(os.environ.get("AIOHTTP_NOSENDFILE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #1092ca295a9bd7bb — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/docs/code/client_middleware_cookbook.py:65

                async with req.session.post(url, data=self.refresh_token) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #8de1f8b25ec9e2ea — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/docs/code/client_middleware_cookbook.py:87

                    async with req.session.post(url, data=self.refresh_token) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #6b793a56b5e2d51a — Environment-variable access.

pkgs/python/[email protected]/docs/conf.py:21

    os.getenv("READTHEDOCS", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8fb2c3abdebee119 — Environment-variable access.

pkgs/python/[email protected]/docs/conf.py:22

    and os.environ["READTHEDOCS_VERSION_TYPE"] == "tag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b633d870c9924a9f — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:31

with open(_version_path, encoding="latin1") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #c534c0af5716b7c1 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/client_auth.py:9

    async with session.get("http://httpbin.org/basic-auth/andrew/password") as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #aad066491660ef76 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/client_json.py:9

    async with session.get("http://httpbin.org/get") as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #b0fea946a1011a33 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/curl.py:12

        async with session.request("GET", url) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #95cd5ef9aa02a8bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/digest_auth_qop_auth.py:48

            async with session.get(url) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #2c209464d9d25836 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/fake_server.py:109

        async with session.get(
            "https://graph.facebook.com/v2.7/me", params={"access_token": token}
        ) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #194b205f09e0a2b9 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/fake_server.py:114

        async with session.get(
            "https://graph.facebook.com/v2.7/me/friends", params={"access_token": token}
        ) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #97c1995cd068a7bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/logging_middleware.py:147

            coro = session.get(f"http://localhost:8080/hello/User{i}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #0dd7a4897b6e923e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/token_refresh_middleware.py:65

            async with session.post(
                self.token_endpoint,
                json={"refresh_token": self.refresh_token},
                middlewares=(),  # Disable middleware for this request
            ) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #269b79c1e130aa6c — Filesystem access.

pkgs/python/[email protected]/examples/web_ws.py:20

        with open(WS_FILE, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #714d7d0754edcdd6 — Filesystem access.

pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:12

data = tomllib.loads(Path("pyproject.toml").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52a818f8a6e04961 — Filesystem access.

pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:19

with open(Path("requirements", "runtime-deps.in"), "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #316a39e2c28e0cd5 — Environment-variable access.

pkgs/python/[email protected]/setup.py:13

    os.environ.get("AIOHTTP_USE_SYSTEM_DEPS", os.environ.get("USE_SYSTEM_DEPS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ebcaa0a318dea8bb — Environment-variable access.

pkgs/python/[email protected]/setup.py:15

NO_EXTENSIONS: bool = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #672b4db7b80218c3 — Environment-variable access.

pkgs/python/[email protected]/setup.py:16

CYTHON_TRACING: bool = bool(os.environ.get("AIOHTTP_CYTHON_TRACE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2aa26267a85dbbda — Filesystem access.

pkgs/python/[email protected]/tools/check_sum.py:30

        hasher.update(full_src.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #07968b3486ba6509 — Filesystem access.

pkgs/python/[email protected]/tools/check_sum.py:37

        dst_hash = dst.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #46b5a4351205d3c1 — Filesystem access.

pkgs/python/[email protected]/tools/check_sum.py:41

        dst.write_text(src_hash)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0fcad7b45fed0882 — Filesystem access.

pkgs/python/[email protected]/tools/cleanup_changes.py:30

    changes = (root / "CHANGES.rst").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f3487cebe278373b — Filesystem access.

pkgs/python/[email protected]/tools/gen.py:16

    code = compile(hdrs_file.read_text(), str(hdrs_file), "exec")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

aiortc

python dependency

expand_more 12 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #c63301be57861e93 — Filesystem access.

pkgs/python/[email protected]/examples/datachannel-filexfer/filexfer.py:106

        fp = open(args.filename, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #98293e77f1727a8d — Filesystem access.

pkgs/python/[email protected]/examples/datachannel-filexfer/filexfer.py:109

        fp = open(args.filename, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3f24fb66af8369f3 — Filesystem access.

pkgs/python/[email protected]/examples/datachannel-vpn/tuntap.py:86

        self.fd = open("/dev/net/tun", "rb+", buffering=0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #0d2276790596142d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/janus/janus.py:28

        async with self._session._http.post(self._url, json=message) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #013b3e644de5310b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/janus/janus.py:51

        async with self._http.post(self._session_url, json=message) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #cfab39fa0a00daa1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/janus/janus.py:62

        async with self._http.post(self._root_url, json=message) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #07fa065e87e8c087 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/janus/janus.py:77

            async with self._http.post(self._session_url, json=message) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #fc446f51b90a6ecf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/janus/janus.py:89

            async with self._http.get(self._session_url, params=params) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #b068a0d0e63dcb8a — Filesystem access.

pkgs/python/[email protected]/examples/server/server.py:93

    content = open(os.path.join(ROOT, "index.html"), "r").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #521d205f0e575ef4 — Filesystem access.

pkgs/python/[email protected]/examples/server/server.py:98

    content = open(os.path.join(ROOT, "client.js"), "r").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9553bd2681f504dd — Filesystem access.

pkgs/python/[email protected]/examples/webcam/webcam.py:67

    content = open(os.path.join(ROOT, "index.html"), "r").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e740a59f74087306 — Filesystem access.

pkgs/python/[email protected]/examples/webcam/webcam.py:72

    content = open(os.path.join(ROOT, "client.js"), "r").read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

anthropic

python dependency

expand_more 122 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #a40fd2ef7019ea54 — Environment-variable access.

pkgs/python/[email protected]/examples/agents.py:9

    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #fbbc9fd719e684f1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:15 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:15

    print("Created environment:", environment.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #1d4bd811f2c9f559 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:22 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:22

    print("Created agent:", agent.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #1ec5a93e8e23dc21 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:29 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:29

    print("Created session:", session.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #acca091718cf1ca1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:45 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents.py:45

            print(event.to_json(indent=2))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #d341c09548a6088f — Environment-variable access.

pkgs/python/[email protected]/examples/agents_comprehensive.py:18

    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e39a573915ff27cc — Environment-variable access.

pkgs/python/[email protected]/examples/agents_comprehensive.py:20

    github_token = os.environ.get("GITHUB_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #21b88e481ab0b9d9 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:28 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:28

    print("Created environment:", environment.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #78b52ac72c3ca474 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:32 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:32

    print("Created vault:", vault.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #e64cb519fb6bbf80 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:43 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:43

    print("Created credential:", credential.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #2aca986d88414f50 — Filesystem access.

pkgs/python/[email protected]/examples/agents_comprehensive.py:47

    with open(skill_md_path, "rb") as skill_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #b1ee3985708e9158 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:52 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:52

    print("Created skill:", skill.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #4c697ae789a1f69a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:75 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:75

    print("Created agent v1:", agent_v1.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #c9216d28fd2ddd53 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:86 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:86

    print("Patched agent to v2:", agent.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #b1c3c5de78a5e23d — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:89 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:89

    print("Agent versions:", versions.data)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #188b08e50cdde615 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:97 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:97

    print("Created session:", session.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #ce2dd933321c0b8b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:108 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_comprehensive.py:108

            print(event.to_json(indent=2))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #09a671fd2d971fd4 — Environment-variable access.

pkgs/python/[email protected]/examples/agents_with_files.py:10

    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #c1e1b265ddc51d53 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:16 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:16

    print("Created environment:", environment.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #77700a8c2d831aad — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:32 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:32

    print("Created agent:", agent.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #30400ffd0a1052e7 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:38 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:38

    print("Uploaded file:", file.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #6da7d81aff857dfc — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:52 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:52

    print("Created session:", session.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #b41275867d73ec17 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:55 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:55

    print("Listed session resources:", resources.data)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #ed6b94a591c25234 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:76 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/agents_with_files.py:76

            print(event.to_json(indent=2))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #32eace33247dfa41 — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-observe-tool-calls.py:46

    val = os.environ.get(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a2a41536a4afc3d5 — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-observe-tool-calls.py:64

    workdir = os.environ.get("ANTHROPIC_WORKDIR", ".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8c0e88ac27556cdb — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-self-hosted-sandbox-worker.py:48

    val = os.environ.get(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #257c1222e88f8a3a — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-self-hosted-sandbox-worker.py:60

    workdir = os.environ.get("ANTHROPIC_WORKDIR", ".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cbb78ea3f0718114 — Environment-variable access.

pkgs/python/[email protected]/examples/workload_identity.py:70

        identity_token_provider=lambda: os.environ["ANTHROPIC_IDENTITY_TOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #48307f761b9d6ea4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/anthropic/_base_client.py:325

        return await self._client.request(self._page_cls, self._options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #3203cd4313085511 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:107

    if api_key is not None and os.environ.get("ANTHROPIC_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #073b0bdda2d2b527 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:109

    if auth_token is not None and os.environ.get("ANTHROPIC_AUTH_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9cdde0612fd619e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:214

            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #702777102c3820cf — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:215

            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e6aca6fdcafcff8 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:221

            webhook_key = os.environ.get("ANTHROPIC_WEBHOOK_SIGNING_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81fa3709381d118d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:225

            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d827451abeb0be8e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:234

        custom_headers_env = os.environ.get("ANTHROPIC_CUSTOM_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df3bc0f8ef30bb9e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:634

            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dfcfaaf1f8b9de7 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:635

            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88aa4452982e7374 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:641

            webhook_key = os.environ.get("ANTHROPIC_WEBHOOK_SIGNING_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0124c5da271554c6 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:645

            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65a496f8b037f983 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:654

        custom_headers_env = os.environ.get("ANTHROPIC_CUSTOM_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c058acb68e60a7b8 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:69

            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12471795e57660b5 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:81

        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1a2d1ea44e67ed3 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:111

            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b08bdd1d7126061 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:123

        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6efa63e95b718baf — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_legacy_response.py:464

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e53d603753e26ba — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_legacy_response.py:477

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87a5cec37ad9bb25 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_models.py:120

            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f2f584e4df139d1 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_response.py:537

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #282229bdad7052ab — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_response.py:579

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74fc805d465d4f92 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_utils/_logs.py:17

    env = os.environ.get("ANTHROPIC_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aac524bb21ace7c4 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:250

            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6749478366428e8 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:418

            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80c56662ca7d09da — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_utils/_utils.py:379

    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54b4514e8607e2c0 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/_files.py:25

        files.append((path.relative_to(relative_to).as_posix(), path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7535c9041b3a60dd — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/_files.py:42

        files.append((path.relative_to(relative_to).as_posix(), await path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f21b4217180e83fe — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/aws/_credentials.py:25

        value = os.environ.get(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cb25f53f3b5f1db — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/aws/_credentials.py:90

    return os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afdacc78fb193774 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:77

    aws_region = os.environ.get("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d49cf367a0122e16 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:165

            api_key = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #671d074ddc8c55f8 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:190

            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efc119fed919bb29 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:345

            api_key = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ca1371f71704470 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:370

            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bdf5faee548b7edb — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_mantle.py:144

        base_url = os.environ.get("ANTHROPIC_BEDROCK_MANTLE_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc4aeb9f4c10a833 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:33

    federation_rule_id = os.environ.get(ENV_FEDERATION_RULE_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d92d1c4c05846a9b — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:34

    organization_id = os.environ.get(ENV_ORGANIZATION_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64d08715216df81f — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:35

    has_literal_token = ENV_IDENTITY_TOKEN in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51c2740eeb7d0ce7 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:50

            value = os.environ.get(ENV_IDENTITY_TOKEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2492abf3a6b63510 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:65

        service_account_id=os.environ.get(ENV_SERVICE_ACCOUNT_ID),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17734fe117803bce — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:69

        workspace_id=os.environ.get(ENV_WORKSPACE_ID) or None,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6714bd1fc7e410c0 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:70

        scope=os.environ.get(ENV_SCOPE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d68d550b9a83688e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:108

    if os.environ.get(ENV_API_KEY):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0212acbdbd03e12a — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:112

    auth_token = os.environ.get(ENV_AUTH_TOKEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c89669ffe7ca578d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:119

    env_explicit = bool(os.environ.get(ENV_PROFILE) or os.environ.get(ENV_CONFIG_DIR))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45e771fde1c6f090 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:78

    env = os.environ.get(ENV_CONFIG_DIR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d32b4f140b976508 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:82

        appdata = os.environ.get("APPDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3b3867dbdd0e32e — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:92

        name = (_config_dir() / "active_config").read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51b42f948e2dff49 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:105

    env = os.environ.get(ENV_PROFILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68c9b66194f08649 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:224

    env = os.environ.get(ENV_IDENTITY_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88b16ef74a282d4d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:240

    if os.environ.get(ENV_PROFILE) or os.environ.get(ENV_CONFIG_DIR):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #969f74801fe30889 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:244

    if os.environ.get(ENV_FEDERATION_RULE_ID) and os.environ.get(ENV_ORGANIZATION_ID):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84626b24ae468743 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:245

        if os.environ.get(ENV_IDENTITY_TOKEN_FILE) or os.environ.get(ENV_IDENTITY_TOKEN):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fcc917cc2ddd2913 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:96

            v = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #214f8d68898558c7 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:110

            v = os.environ.get(ENV_IDENTITY_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #912fa8b19072df44 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:136

        value = os.environ.get(self._env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a7cd01bbb16e2e91 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:284

            raw = self._config_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4411391b9b1f5743 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:374

            creds: Dict[str, Any] = _wrap_secret_fields(json.loads(path.read_text(encoding="utf-8")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #be7c28d2638c021a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:538

            resp = self._get_http_client().post(
                f"{self._base_url}{TOKEN_ENDPOINT}",
                # Serialized inline so the raw request bytes are never bound
                # to a local here; SecretStr values unwrap at dump time.
                content=_json_dumps_secrets(body),
                headers={
                    "Content-Type": "application/json",
                    # oauth-2025-04-20 unlocks the token endpoint family. Do
                    # NOT send oidc-federation-2026-04-01 — that's a routing
                    # switch that misroutes refresh_token grants to the Go
                    # userauth handler, which only accepts jwt-bearer.
                    "anthropic-beta": OAUTH_API_BETA_HEADER,
                    "User-Agent": _user_agent(),
                },
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #78aa432807061fca — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:746

            content = self._path.read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #49fc3a48971cb0be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_workload.py:259

            resp = self._http_client.post(
                url,
                # Serialized inline so the raw request bytes are never bound
                # to a local here; SecretStr values unwrap at dump time.
                content=_json_dumps_secrets(body),
                headers={
                    "anthropic-beta": _JWT_BEARER_BETA_HEADER,
                    "Content-Type": "application/json",
                    "User-Agent": _user_agent(),
                },
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2ab195bf34203a5d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/environments/_worker.py:160

    resolved = value or os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66131d75ba553839 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:157

        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac0e2e1f436f4835 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:158

        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2634e744e39524ec — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:159

        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a273090bb0d0244 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:382

        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffd7cdc9d0025299 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:383

        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4be0d8a671f1450d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:384

        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f0888fd5867badb — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:247

            location = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_LOCATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b68aca4db3a5f0d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:252

            project = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e342a034fafb73d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:254

            project = os.environ.get("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e2459426a85342c — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:260

            base_url = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47e8a93680b65951 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:266

            workspace_id = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57e26b0fab4251d6 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:493

            location = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_LOCATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c738aa6948e8fe03 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:498

            project = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f54b3cde8237e8c7 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:500

            project = os.environ.get("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62e2bf9f32c6b155 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:506

            base_url = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb1d745de0196948 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:510

            workspace_id = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #363246352bed7548 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:356

        return full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #4d76743d1fd9f9e9 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:653

        return await full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #54015969e11542e6 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_skills.py:138

                with zf.open(info) as src, open(target, "wb") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #16c4c1d67f289b3e — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_skills.py:164

            with extracted as src, open(target, "wb") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #abb31ebbd23f5274 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:123

    return {k: v for k, v in os.environ.items() if not k.startswith("ANTHROPIC_")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #95e9d2084727bae5 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:512

            text = target.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #a69a07e76fb321e1 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:540

            target.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #2c90a2b7054f44f1 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:570

            text = target.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #794f4eba1be0a39c — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:582

            target.write_text(updated)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4cf74a0539565e32 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:46

        project_id = os.environ.get("ANTHROPIC_VERTEX_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61b1daff11494001 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:114

            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e4e53dfbd98df2e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:121

            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2431d33fe87bf85e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:278

            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c3d86e6a7540378 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:285

            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

autogen-agentchat

python dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #1bde92d843e71ae8 — Environment-variable access.

pkgs/python/[email protected]/src/autogen_agentchat/ui/_console.py:23

    return os.getenv("TERM_PROGRAM") == "iTerm.app"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

boto3

python dependency

expand_more 4 low-confidence finding(s)

low env_fs tooling reachable #b9889cc8c92fdaa0 — Filesystem access.

pkgs/python/[email protected]/boto3/docs/__init__.py:50

        with open(service_doc_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #79bee60b52c4db9e — Filesystem access.

pkgs/python/[email protected]/boto3/docs/service.py:200

            with open(examples_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6a22d97217fa042 — Filesystem access.

pkgs/python/[email protected]/setup.py:24

    init = open(os.path.join(ROOT, 'boto3', '__init__.py')).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8885d28098e19e60 — Filesystem access.

pkgs/python/[email protected]/setup.py:32

    long_description=open('README.rst').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

click

python dependency

expand_more 31 low-confidence finding(s)

low env_fs dependency Excluded from app score #d6dceb21d7880237 — Filesystem access.

pkgs/python/[email protected]/src/click/_compat.py:366

        return open(file, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4a00ad24ad2feac — Filesystem access.

pkgs/python/[email protected]/src/click/_compat.py:368

    return open(file, mode, encoding=encoding, errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #860cb5c889a06582 — Environment-variable access.

pkgs/python/[email protected]/src/click/_termui_impl.py:418

    pager_cmd_parts = shlex.split(os.environ.get("PAGER", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b112e74f05de1179 — Environment-variable access.

pkgs/python/[email protected]/src/click/_termui_impl.py:424

    if os.environ.get("TERM") in ("dumb", "emacs"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1fac0f874d77c976 — Environment-variable access.

pkgs/python/[email protected]/src/click/_termui_impl.py:516

    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #668fbac131dedb5d — Environment-variable access.

pkgs/python/[email protected]/src/click/_termui_impl.py:521

        less_flags = f"{os.environ.get('LESS', '')}{' '.join(cmd_params)}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e901f2a9b8189534 — Environment-variable access.

pkgs/python/[email protected]/src/click/_termui_impl.py:673

            rv = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44eafdcde3592f68 — Environment-variable access.

pkgs/python/[email protected]/src/click/_termui_impl.py:695

            environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d8e4f18ee99e2b3 — Filesystem access.

pkgs/python/[email protected]/src/click/_termui_impl.py:761

            with open(name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e52a0b5a41f7f04 — Filesystem access.

pkgs/python/[email protected]/src/click/_termui_impl.py:790

        null = open("/dev/null", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9cd267b14cc4115e — Filesystem access.

pkgs/python/[email protected]/src/click/_termui_impl.py:916

            f = open("/dev/tty")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae292f6f59182ac5 — Filesystem access.

pkgs/python/[email protected]/src/click/core.py:1243

                formatter.write_text(text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6460ab1dda7c60cc — Filesystem access.

pkgs/python/[email protected]/src/click/core.py:1264

                formatter.write_text(epilog)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a196e04c0107256 — Environment-variable access.

pkgs/python/[email protected]/src/click/core.py:1557

        instruction = os.environ.get(complete_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71a3db65fcd653ff — Environment-variable access.

pkgs/python/[email protected]/src/click/core.py:2631

            rv = os.environ.get(self.envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a007aae0cd402d06 — Environment-variable access.

pkgs/python/[email protected]/src/click/core.py:2637

                rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #459625ab362445f5 — Environment-variable access.

pkgs/python/[email protected]/src/click/core.py:3402

            rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aba4972a034133c1 — Environment-variable access.

pkgs/python/[email protected]/src/click/shell_completion.py:371

        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2e19137def914a4 — Environment-variable access.

pkgs/python/[email protected]/src/click/shell_completion.py:372

        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e075d3f5423bd86 — Environment-variable access.

pkgs/python/[email protected]/src/click/shell_completion.py:393

        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da5b50bbde9159ed — Environment-variable access.

pkgs/python/[email protected]/src/click/shell_completion.py:394

        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e84e6a1479835e1d — Environment-variable access.

pkgs/python/[email protected]/src/click/shell_completion.py:429

        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74a1018f9c8a7821 — Environment-variable access.

pkgs/python/[email protected]/src/click/shell_completion.py:430

        incomplete = os.environ["COMP_CWORD"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2572e2fef6f04b15 — Environment-variable access.

pkgs/python/[email protected]/src/click/testing.py:567

                old_env[key] = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #365087d9f904eef3 — Environment-variable access.

pkgs/python/[email protected]/src/click/testing.py:570

                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8df4f2874065239 — Environment-variable access.

pkgs/python/[email protected]/src/click/testing.py:574

                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9dedf87b92736cbc — Environment-variable access.

pkgs/python/[email protected]/src/click/testing.py:580

                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81bc8a159d18278a — Environment-variable access.

pkgs/python/[email protected]/src/click/testing.py:584

                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #daf2c8fa96999cb9 — Filesystem access.

pkgs/python/[email protected]/src/click/utils.py:149

                open(filename, mode).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d36f3b522f31452 — Environment-variable access.

pkgs/python/[email protected]/src/click/utils.py:506

        folder = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e6e493d048d8c2a — Environment-variable access.

pkgs/python/[email protected]/src/click/utils.py:517

        os.environ.get("XDG_CONFIG_HOME", os.path.expanduser("~/.config")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

defusedxml

python dependency

expand_more 8 low-confidence finding(s)

low env_fs dependency Excluded from app score #ee678eb3b36eaec6 — Filesystem access.

pkgs/python/[email protected]/defusedxml/expatbuilder.py:84

        fp = open(file, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c685cffcb47fb55 — Filesystem access.

pkgs/python/[email protected]/other/python_genshi.py:6

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d90732573836c32b — Filesystem access.

pkgs/python/[email protected]/setup.py:27

with open("README.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54fc25ca2adac136 — Filesystem access.

pkgs/python/[email protected]/setup.py:29

with open("CHANGES.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0340e27883cd7991 — Environment-variable access.

pkgs/python/[email protected]/tests.py:59

os.environ["http_proxy"] = "http://127.0.9.1:9"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #623f1c7c33e5636a — Environment-variable access.

pkgs/python/[email protected]/tests.py:60

os.environ["https_proxy"] = os.environ["http_proxy"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30adba7df569360f — Environment-variable access.

pkgs/python/[email protected]/tests.py:61

os.environ["ftp_proxy"] = os.environ["http_proxy"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4a60f0c9d857925 — Filesystem access.

pkgs/python/[email protected]/tests.py:83

        with io.open(xmlfile, mode) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-genai

python dependency

expand_more 87 low-confidence finding(s)

low env_fs dependency Excluded from app score #95bf37f1adb3dce1 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:110

  env_google_api_key = os.environ.get('GOOGLE_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #474a8321a3a5cb2d — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:111

  env_gemini_api_key = os.environ.get('GEMINI_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c99d0e2731e37362 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:616

      env_enterprise_str = os.environ.get('GOOGLE_GENAI_USE_ENTERPRISE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e384b40fe2a39f0 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:617

      env_vertexai_str = os.environ.get('GOOGLE_GENAI_USE_VERTEXAI', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b616199619eb4db — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:677

    env_project = os.environ.get('GOOGLE_CLOUD_PROJECT', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8bd94adbb418dc2f — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:678

    env_location = os.environ.get('GOOGLE_CLOUD_LOCATION', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b96461b3a37afdd — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1046

          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f68809a7aad6375 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1047

          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b0f20462a86e83b — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1100

          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aae54633c44e2140 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1101

          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef38a466eacfea7e — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1158

          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #871574f613ebfec5 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1159

          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e13d77911438cdf — Filesystem access.

pkgs/python/[email protected]/google/genai/_api_client.py:1764

      with open(file_path, 'rb') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd6745d8a466621c — Environment-variable access.

pkgs/python/[email protected]/google/genai/_base_url.py:48

    return _default_base_vertex_url or os.getenv('GOOGLE_VERTEX_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5893867f48b399d0 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_base_url.py:50

    return _default_base_gemini_url or os.getenv('GOOGLE_GEMINI_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2448b7dcf0818e88 — Filesystem access.

pkgs/python/[email protected]/google/genai/_gaos/types/base64fileinput.py:39

            with open(value, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2cf5e2aa30424a4b — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/logger.py:40

    if os.getenv("GOOGLE_GENAI_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3df07cc0869fce9a — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:95

    if os.getenv("GOOGLE_GENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d2ac63333406c5f — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:96

        security_dict["api_key"] = os.getenv("GOOGLE_GENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1171e8d15f80efb8 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:98

    if os.getenv("GOOGLE_GENAI_ACCESS_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #214173df730b8110 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:99

        security_dict["access_token"] = os.getenv("GOOGLE_GENAI_ACCESS_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26cdc9402335ea1e — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:101

    if os.getenv("GOOGLE_GENAI_DEFAULT_HEADERS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75cb0912c77777a0 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:102

        security_dict["default_headers"] = os.getenv("GOOGLE_GENAI_DEFAULT_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7ef75a2a9182684 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/values.py:79

    env_value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #7a283ec0ce188aa8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:82

  resp = requests.get(file_url_path)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #bd1bfe4694c3f02b — Filesystem access.

pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:111

  with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #250cbf2ba505fae3 — Filesystem access.

pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:128

    with open(tmp_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04b53d4e4e18b02e — Environment-variable access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:223

      os.environ.get('PYTEST_CURRENT_TEST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b4545f9605e6e69 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:315

      self.replays_directory = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c11f41f062f2153 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:315

      self.replays_directory = os.environ.get(
          'GOOGLE_GENAI_REPLAYS_DIRECTORY', None
      )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a1b48538a510f89 — Filesystem access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:359

      with open(replay_file_path, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08e9b7c7dc30b6ee — Filesystem access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:386

    with open(replay_file_path, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #d5ced92a80a84280 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:1827

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f685c5b4366d726c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:1906

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bfaca4f5d33ddc69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2001

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cf887b65caab647f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2097

    self._api_client.request('post', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7f10c98b6435e7c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2138

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #54a612daad55bff8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2236

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5c93f914f1f3fac1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1227

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #52a8acf67c1be0df — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1309

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c266d1f2d5a2b1b0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1391

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6719210739c64202 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1486

    response = self._api_client.request(
        'patch', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fbf14ae991af2422 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1553

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #912455c8ff11b0ee — Environment-variable access.

pkgs/python/[email protected]/google/genai/client.py:215

      default_factory=lambda: os.getenv('GOOGLE_GENAI_CLIENT_MODE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98d8c6c0d8fe7f4a — Environment-variable access.

pkgs/python/[email protected]/google/genai/client.py:219

      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAYS_DIRECTORY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ea3890504d78af7 — Environment-variable access.

pkgs/python/[email protected]/google/genai/client.py:223

      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAY_ID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #bf8551471064c200 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/documents.py:180

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #72132a84b0fb301d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/documents.py:258

    self._api_client.request('delete', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3572852bd6378509 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/documents.py:301

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7a7217b2f0a7c00d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:380

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8b34e47618128fcb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:461

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #14d8f5769353d8de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:540

    self._api_client.request('delete', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2db2cd49bc4c88c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:579

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8162edab0a55880c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:654

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #93687ffec6fc35f3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:758

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #63e82110e8eb9447 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:221

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f0545093a15497ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:293

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c55ef7e4c826c03e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:386

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #89cd4f9fc49c0c37 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:466

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #82e0bcd0534ca5e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:540

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #19216824ee8425ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:4986

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aca2c18740f84297 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5215

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #61e3b96534b6121b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5306

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d83ee58bd5877a9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5395

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1ebfe38e62bd15e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5479

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ecc14c67854804e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5591

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #174a6c1965b26695 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5694

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f032d0d9425f04c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5771

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #47252a730f169fe1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5851

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b7f7b1e01d4170b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5936

    response = self._api_client.request(
        'patch', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9a07726853f5326b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6017

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #870c87bf84251145 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6127

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d9e4700d09019dfa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6235

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4570ac39cdabc843 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6327

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2932c0d002b9f508 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/operations.py:138

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #34239795994dc348 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/operations.py:189

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d876bda420fb16cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/operations.py:238

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1b779423d8ee112c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tokens.py:257

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7e4cd786eae1ce4e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2490

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9c334a5a11ef00f4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2567

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #eb29a534c680e48a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2653

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #42631327c32ddb71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2751

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1573903e95892364 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2844

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ae4084d1cb8bf829 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2961

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #e1619d784c7a5ce8 — Filesystem access.

pkgs/python/[email protected]/google/genai/types.py:9089

    image_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10f87f7d8a0a05da — Filesystem access.

pkgs/python/[email protected]/google/genai/types.py:11474

    video_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c89f7ccd51539245 — Filesystem access.

pkgs/python/[email protected]/google/genai/types.py:22544

    with open(file_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx

python dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #b94b7a2ab164f129 — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:34

        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd4edb638a16eafa — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:35

            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1adc7230ce7d269d — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:36

        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aabf91319536c855 — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:37

            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

jinja2

python dependency

expand_more 7 low-confidence finding(s)

low env_fs dependency Excluded from app score #b3bb7ec0ed3d289d — Filesystem access.

pkgs/python/[email protected]/src/jinja2/bccache.py:270

            f = open(filename, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #99fcc1e17633f952 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/jinja2/bccache.py:390

            code = self.client.get(self.prefix + bucket.key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #4386a3dd4e7b618e — Filesystem access.

pkgs/python/[email protected]/src/jinja2/environment.py:860

                with open(os.path.join(target, filename), "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6dbe32a638c638a — Filesystem access.

pkgs/python/[email protected]/src/jinja2/environment.py:1611

            real_fp: t.IO[bytes] = open(fp, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bbe821372f48ea6 — Filesystem access.

pkgs/python/[email protected]/src/jinja2/loaders.py:214

        with open(filename, encoding=self.encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6078fb0ec175afb7 — Filesystem access.

pkgs/python/[email protected]/src/jinja2/loaders.py:382

            with open(p, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9b64350babaee7d — Filesystem access.

pkgs/python/[email protected]/src/jinja2/utils.py:171

    return open(filename, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

microsoft-agents-activity

python dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #9507fab93c45898e — Filesystem access.

pkgs/python/[email protected]/setup.py:7

    with open(version_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd1cf803f9486135 — Environment-variable access.

pkgs/python/[email protected]/setup.py:10

    package_version = environ.get("PackageVersion", "0.0.0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

microsoft-agents-copilotstudio-client

python dependency

expand_more 13 low-confidence finding(s)

low env_fs dependency Excluded from app score #84eb68143840cc01 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:88

        env_id = environment_id or environ.get("ENVIRONMENT_ID", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #692c1572e4fbeb26 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:89

        agent_id = agent_identifier or environ.get("AGENT_IDENTIFIER", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff5990b0a3b38b45 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:94

            cloud_str = environ.get("CLOUD", "PROD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab5053493c8e8637 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:103

            agent_type_str = environ.get("COPILOT_AGENT_TYPE", "PUBLISHED")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ebdf2fed8b561a57 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:110

        custom_cloud = custom_power_platform_cloud or environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8564258d5c0f412c — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:110

        custom_cloud = custom_power_platform_cloud or environ.get(
            "CUSTOM_POWER_PLATFORM_CLOUD", None
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9a80fef7319c5b3 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:113

        direct_url = direct_connect_url or environ.get("DIRECT_CONNECT_URL", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d3084960bfe2960 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:119

                environ.get("USE_EXPERIMENTAL_ENDPOINT", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76cfe341c1622df9 — Environment-variable access.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/connection_settings.py:124

            diagnostics = environ.get("ENABLE_DIAGNOSTICS", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #380c70cddf258968 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/copilot_client.py:58

            async with session.post(url, json=data, headers=headers) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ef7c49510df5fd80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/microsoft_agents/copilotstudio/client/copilot_client.py:278

            async with session.get(url, headers=headers) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #a8feb9143270c7e6 — Filesystem access.

pkgs/python/[email protected]/setup.py:7

    with open(version_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03a651294669fc6d — Environment-variable access.

pkgs/python/[email protected]/setup.py:10

    package_version = environ.get("PackageVersion", "0.0.0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

motor

python dependency

expand_more 7 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #6b1c9fa0027524fd — Filesystem access.

pkgs/python/[email protected]/doc/examples/auto_csfle_example.py:46

    with open("jsonSchema.json", "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #96be813fb3886fd6 — Filesystem access.

pkgs/python/[email protected]/doc/examples/auto_csfle_example.py:77

    with open("jsonSchema.json") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d86c7143a1802d3 — Environment-variable access.

pkgs/python/[email protected]/motor/frameworks/asyncio/__init__.py:61

if "MOTOR_MAX_WORKERS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8189b645e0aabc86 — Environment-variable access.

pkgs/python/[email protected]/motor/frameworks/asyncio/__init__.py:62

    max_workers = int(os.environ["MOTOR_MAX_WORKERS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65305e7a24d1a2e4 — Environment-variable access.

pkgs/python/[email protected]/motor/frameworks/tornado/__init__.py:57

if "MOTOR_MAX_WORKERS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5ff052f01aa8d9f — Environment-variable access.

pkgs/python/[email protected]/motor/frameworks/tornado/__init__.py:58

    max_workers = int(os.environ["MOTOR_MAX_WORKERS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf846deb5f48ed5b — Environment-variable access.

pkgs/python/[email protected]/synchro/synchrotest.py:385

    if os.environ.get("CHECK_EXCLUDE_PATTERNS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

numpy

python dependency

expand_more 982 low-confidence finding(s)

low env_fs dependency Excluded from app score #33891092be734e8e — Filesystem access.

pkgs/python/[email protected]/.spin/cmds.py:124

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38ce056c81a785f4 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:326

    PATH = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41e6436cb949d263 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:331

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d5a848959e8c96a — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:505

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b681d97f2037ffa5 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:523

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19352a35d987de37 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:547

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a7d09f96fd7b01d — Filesystem access.

pkgs/python/[email protected]/.spin/cmds.py:629

        with open(local, "wt", encoding="utf8") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #182aa9b4e3657d7d — Filesystem access.

pkgs/python/[email protected]/.spin/cmds.py:632

        with open(pkg_config_fname, "wt", encoding="utf8") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ffc9bcedcd8083c1 — Environment-variable access.

pkgs/python/[email protected]/benchmarks/benchmarks/__init__.py:12

    if 'SHELL' in os.environ and sys.platform != 'win32':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ed13746e6b8f8337 — Filesystem access.

pkgs/python/[email protected]/benchmarks/benchmarks/__init__.py:35

        with open(lock_path, 'a+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #45abeb451358e94a — Filesystem access.

pkgs/python/[email protected]/doc/neps/tools/build_index.py:34

        with open(source) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #826da4ff3a748691 — Filesystem access.

pkgs/python/[email protected]/doc/neps/tools/build_index.py:125

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7bbcbceaf222ad2 — Filesystem access.

pkgs/python/[email protected]/doc/postprocess.py:18

        with open(fn, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86e6cea527714795 — Filesystem access.

pkgs/python/[email protected]/doc/postprocess.py:24

        with open(fn, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #840811fa1af3bbd4 — Filesystem access.

pkgs/python/[email protected]/doc/preprocess.py:18

    with open(gen_path, 'w') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32696168281add3d — Filesystem access.

pkgs/python/[email protected]/doc/preprocess.py:35

    with open(os.path.join(dsrc_path, "doxyfile")) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae8cd51acc82f24c — Filesystem access.

pkgs/python/[email protected]/doc/preprocess.py:44

            with open(conf_path) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fa29836bed5b722 — Environment-variable access.

pkgs/python/[email protected]/doc/source/conf.py:247

if os.environ.get('CIRCLE_JOB') and os.environ['CIRCLE_BRANCH'] != 'main':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed45eeb886c139cf — Environment-variable access.

pkgs/python/[email protected]/doc/source/conf.py:249

    switcher_version = os.environ['CIRCLE_BRANCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1aafe45f8bebc34f — Environment-variable access.

pkgs/python/[email protected]/numpy/__init__.py:881

        use_hugepage = os.environ.get("NUMPY_MADVISE_HUGEPAGE", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f11b142a3cebd4e — Environment-variable access.

pkgs/python/[email protected]/numpy/__init__.py:913

    if (os.environ.get("NPY_PROMOTION_STATE", "weak") != "weak"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51d4bc6298ba7457 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:270

    with open(source) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #007fe87eb96725c5 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:320

        fid = open(file, 'r')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff1989ffe202b410 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:323

        outfile = open(newname, 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #358fcf001d263ca6 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:8

    with open(init) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #556023b9817c3fd8 — Environment-variable access.

pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:89

                os.environ.get('MESON_DIST_ROOT', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8114bb6039e188f8 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:98

        with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5c39abe55ae9720 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/process_src_template.py:32

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a57527a4abc0fdd5 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita.py:34

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dcc90690e2ce4c13 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:164

        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d4bbbe5aae8ddbb — Environment-variable access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1090

        vars.update(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eafa03bb88a0d29a — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1104

        with open(template_name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d61271bba8bdb7db — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1109

        with open(options.output, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #954a3985253d30fe — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/__init__.py:17

    if envkey not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02b5ffc3a6c57e3c — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/_add_newdocs_scalars.py:60

            machine = os.environ.get('PROCESSOR_ARCHITEW6432', '') \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6037fe36fe96118 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/_add_newdocs_scalars.py:61

                    or os.environ.get('PROCESSOR_ARCHITECTURE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d15e401782615138 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/_methods.py:242

        ctx = open(os.fspath(file), "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #945e7d155513721a — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:249

        fo = open(filename, 'r')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fdf356d7b0a0dfdc — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:321

        with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71ddcb5ac2060b76 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:325

    with open(filename, 'w') as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2450401eb18b9a32 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:537

    with open(file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #49271a2c8185b09d — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/generate_umath.py:1689

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc2eb18dffcaf6d4 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/generate_umath_doc.py:20

    with open(target, 'w') as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc5d74e6a7a126ae — Filesystem access.

pkgs/python/[email protected]/numpy/_core/memmap.py:235

            f_ctx = open(
                os.fspath(filename),
                ('r' if mode == 'c' else mode) + 'b'
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05e1c1202631dad1 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/records.py:901

        ctx = open(os.fspath(fd), 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d97428deace146e3 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/common/pythoncapi-compat/upgrade_pythoncapi.py:608

        with open(filename, encoding=encoding, errors=errors, newline="") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4b3eaa882df7cfd — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/common/pythoncapi-compat/upgrade_pythoncapi.py:627

        with open(filename, "w", encoding=encoding, errors=errors, newline="") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #ede56ebac8322dc2 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:85

if 'REPO_NAME' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #0e031f9f6b0406fc — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:86

   REPO_NAME = os.environ['REPO_NAME']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #eaaf6985db25d50f — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:91

if 'current_language' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #2f3ff40efeeecae4 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:93

   current_language = os.environ['current_language']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #db45f895c0b75ac6 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:106

if 'current_version' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #8cd4d9d93439901b — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:108

   current_version = os.environ['current_version']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #a499f701cb2e454c — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:59

    data = open(file, 'r').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #fc3b78282c52b8a1 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:73

        with open(ext_file, 'w') as handler:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #12b3976df88ea5cf — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:83

            data = open(ext_file, 'r').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d967b3814d06cda3 — Environment-variable access.

pkgs/python/[email protected]/numpy/conftest.py:60

os.environ["NUMPY_EXPERIMENTAL_DTYPE_API"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62c7d3f6316d3b1b — Environment-variable access.

pkgs/python/[email protected]/numpy/conftest.py:100

        os.environ['NPY_AVAILABLE_MEM'] = available_mem

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62c6fe796e236e39 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/_backends/_meson.py:71

        return self.build_template_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #441fb04a40f0db5c — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/_backends/_meson.py:181

        meson_build_file.write_text(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e952dcdb845de054 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/_src_pyf.py:215

    with open(source) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ebf4284e16f527c — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/auxfuncs.py:920

    with open(source) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f7961d6c334ee26 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/capi_maps.py:158

        with open(f2cmap_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fce8cb50231e56e4 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:318

        with open(filename, 'rb') as fhandle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc5539d41d020288 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:329

    return open(filename, mode, encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37cafd64ff70543a — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:3705

                open(l).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0072147fd88559b3 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:3724

        with open(pyffilename, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4efaa938689507e — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/f2py2e.py:290

                with open(l):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1699bbb771741d54 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/f2py2e.py:357

            with open(options['signsfile'], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2a88b06d1c77c55 — Environment-variable access.

pkgs/python/[email protected]/numpy/f2py/rules.py:161

generationtime = int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c499d24c95fe8077 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1436

    with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #397bf6e5d1a1578d — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1443

        with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b3991270ec4dd6d — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1451

        with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04f41a63cf185e2d — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1464

        with open(wn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c7bb2e20b503618 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1489

        with open(wn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #0dd0f0c8105f1757 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/numpy/lib/_datasource.py:333

            with urlopen(path) as openedurl:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fa9ed6a163a87aed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/numpy/lib/_datasource.py:475

                netfile = urlopen(path)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #505d7227049ae4b4 — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_format_impl.py:968

        with open(os.fspath(filename), mode + 'b') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed92bd74cee30aeb — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_format_impl.py:973

        with open(os.fspath(filename), 'rb') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4d62a955b7d66c0 — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:454

            fid = stack.enter_context(open(os.fspath(file), "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16ca06cd2369e880 — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:568

        file_ctx = open(file, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea612b6063a092d8 — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:1549

        open(fname, 'wt').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bcfd30911ad74eb0 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/clapack_scrub.py:308

    with open(filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3177ea99b451f5b7 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/clapack_scrub.py:318

    with open(outfilename, 'w') as writefo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71bc6a2e72a5462b — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/fortran.py:116

    with open(filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab0a1281aa484ec8 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:230

    with open(wrapped_routines_file) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54464504cece24d0 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:250

        with open(filename, 'w') as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #373495b697b82121 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:256

    with open(output_file, 'w') as output_fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c3f590900a6a24a — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:258

            with open(r.filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a085316e86940d1 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:275

    with open(c_file) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a09ef4f0f20759f — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:278

    with open(c_file, 'w') as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c3e597d1f75cbf5 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:301

        with open(fn) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54606498db31f5f5 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:309

    with open('f2c.h') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a343568c9716a57 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:315

    with open(os.path.join(output_dir, 'lapack_lite_names.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a98f4e2730928c30 — Filesystem access.

pkgs/python/[email protected]/numpy/ma/mrecords.py:626

        f = open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b570a19c8def6e6 — Filesystem access.

pkgs/python/[email protected]/numpy/random/_examples/cffi/parse.py:12

    with open(os.path.join(inc_dir, 'random', 'bitgen.h')) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7cbc0ebcbd45fdb — Filesystem access.

pkgs/python/[email protected]/numpy/random/_examples/cffi/parse.py:21

    with open(os.path.join(inc_dir, 'random', 'distributions.h')) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a97eb4108ab0c01 — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/extbuild.py:209

    with open(cfile.parent / "meson.build", "wt") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe29899cc9a43b3a — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/extbuild.py:223

    with open(native_file_name, "wt") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9131dc701f01f16a — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:72

                np_dist.read_text('direct_url.json') or '{}',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #420ef61fd9051d05 — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:179

            with open(_proc_pid_stat) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bb459dd49073a2d — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:208

            with open(_proc_pid_stat) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f77af29bf99e9513 — Environment-variable access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:2711

    env_value = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75f51738ab9c4a29 — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:2763

        with open('/proc/meminfo') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e164d645684b9318 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:57

        with open(self.path, "r") as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7a3d4e88e9103b3f — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:66

        with open(self.path, 'r') as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #287483f930f02a7f — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:96

            with open(os.path.join(root, self.clean_path(path)), "w") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3be548cd059c55f9 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:97

                source.write_text(fd)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e8ca2b7af3a35a6e — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:101

            with open(
                os.path.join(root, self.clean_path(path) + ".html"), "w"
            ) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9b7daebdc730d921 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:106

        with open(os.path.join(root, 'index.html'), 'w') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5804e52c898b69f1 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:165

        with open(log_file, 'r') as log_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d59a7a4e2220f524 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:176

        files.write_text(args.directory)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3f35b4fd0994ce7e — Filesystem access.

pkgs/python/[email protected]/tools/check_installed_files.py:108

    with open(os.path.join('build', 'meson-info',
                           'intro-install_plan.json'), 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2ad620428819ae0d — Filesystem access.

pkgs/python/[email protected]/tools/check_openblas_version.py:48

        with open(reqfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #11765098831268df — Filesystem access.

pkgs/python/[email protected]/tools/check_python_h_first.py:77

    with open(name_to_check) as in_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fa5d84864bcb6cac — Filesystem access.

pkgs/python/[email protected]/tools/functions_missing_types.py:101

        with open(module_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #681a55cfc058ac9b — Filesystem access.

pkgs/python/[email protected]/tools/get_submodule_paths.py:12

    with open(gitmodule_file) as gitmodules:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #43cebbbdf8be01db — Filesystem access.

pkgs/python/[email protected]/tools/get_submodule_paths.py:19

    with open(
            os.path.join(root_directory, ".gitattributes"), "r"
    ) as attr_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb76654d40c9dff2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:21

        data = json.loads(path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1dbb91f49c6172ee — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:83

        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8ba6531b38f4d4d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:100

        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e52667b87ad1bed — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:140

        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8eb1e3bd3103bdda — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/extensions/refman_links.py:128

        raw = Path(self._data_file).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5bdeb4b6788698e7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/genrelnotes.py:71

            snippet = snippetfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #79d7e3640191db99 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/jsonvalidator.py:146

    root_tmp = json.loads(args.doc_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0d0b71adcc519786 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorjson.py:115

        self.out.write_text(json.dumps(data), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a0e95c3dfb718de8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorman.py:65

        self.path.write_text(self.text, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b6fd69340466d773 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:116

        out_file.write_text(data, encoding='ascii')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #da2ac839bea19dd6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:129

            template=template_file.read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #78d70b26e890e1b8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:360

        raw = self.sitemap_in.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8d931e01a1e35544 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:371

        self.sitemap_out.write_text(out, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c8c6e853ad0c71a2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:393

        self.link_def_out.write_text(json.dumps(data, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #345f1e947d60eb87 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorvim.py:30

            template=template_file.read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ba8b34818dba84cc — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorvim.py:37

        out_file.write_text(result, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4afacfcaed59860b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/loaderbase.py:194

        return f.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #98cb0548282a100c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/loaderpickle.py:16

        res = pickle.loads(self.in_file.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a4db3c9b6b59afef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/main.py:76

        args.depfile.write_text(out_text, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #75ab240e1e580f1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/docs/validatelinks.py:16

        async with session.get(url, timeout=timeout) as r:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #9dc7696b6f2eea83 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/validatelinks.py:24

    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #93eed2506260d519 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/manual tests/4 standalone binaries/build_windows_package.py:14

    response = urllib.request.urlopen(sdl_url, timeout=600.0)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #e594e381224bb287 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/manual tests/4 standalone binaries/build_windows_package.py:16

    open(sdl_filename, 'wb').write(data)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c0ab0d5cc96165b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:454

            return open(outfileabs_tmp, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #071394922ce1e70e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:623

            with open(rsp_file, 'w', encoding='utf-8', newline='\n') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #691722caf2b66236 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:727

        with open(exe_data, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0af7c2081d8173ce — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:734

        with open(test_data, 'wb') as datafile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #907e0fbfdbb94bfe — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:737

        with open(benchmark_data, 'wb') as datafile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c0336e809c30c07 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:902

        with open(pch_file_tmp, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a7ec9b1348eaf81d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1314

        with open(ifilename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c72420c6bc2882d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1345

        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ebacc8b0feab35a7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1676

        with open(install_data_file, 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #49079342a431229d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:548

                return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3581d751685ee66b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:553

            return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57313571274810df — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:557

        with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e140cf70ad0ac45 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:590

                    with open(tempfilename, 'ab') as binfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a8587c1d69e79b7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:592

                    return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df89fcb833f48ea2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:634

        with open(tempfilename, 'w', encoding='utf-8') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1d37c8d83b2fcde — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:716

        with open(os.path.join(self.environment.get_build_dir(), 'rust-project.json'),
                  'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29ff454fa6f1e78b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:748

            with open(os.path.join(builddir, 'compile_commands.json'), 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a88f13f43aef5014 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1169

            with open(pickle_abs, 'rb') as p:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdedc90e0a0f3e2b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1174

            with open(pickle_abs, 'wb') as p:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdbc872fc33809e0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1505

        with open(manifest_fullpath, 'w', encoding='utf-8') as manifest:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd819f578c020d55 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:2896

            with open(filename, encoding='ascii', errors='ignore') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de21d0416985696b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:3377

                in_file = Path(os.environ['VCToolsInstallDir']) / 'modules/std.ixx'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50b5d69b78e39381 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:3934

        with open(d_file, 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7250c6f6bf7cac86 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:36

    vs_version = os.getenv('VisualStudioVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4ffe6067fdb6cb5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:37

    vs_install_dir = os.getenv('VSINSTALLDIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6bf7685b84086d8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:300

        with open(Vs2010Backend.get_regen_stampfile(build_dir), 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e91519bbe8a8ddaf — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:304

        has_arch_values = 'VSCMD_ARG_TGT_ARCH' in os.environ and 'VSCMD_ARG_HOST_ARCH' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c40f7a2089f60374 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:307

        if 'VCINSTALLDIR' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #646d3c09cd15cb31 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:308

            vs_version = os.environ['VisualStudioVersion'] \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b03d4108cbd02958 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:309

                if 'VisualStudioVersion' in os.environ else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #176cfb385f79c320 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:311

            script_path = os.environ['VCINSTALLDIR'] + relative_path + 'vcvarsall.bat'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #602ef24b94e86c86 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:314

                    target_arch = os.environ['VSCMD_ARG_TGT_ARCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f01981a1238da8a3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:315

                    host_arch = os.environ['VSCMD_ARG_HOST_ARCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fac2367570716631 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:317

                    target_arch = os.environ.get('Platform', 'x86')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #162c00b3bb933ba7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:323

        if 'VS150COMNTOOLS' in os.environ and has_arch_values:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc175fd740072d0d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:324

            script_path = os.environ['VS150COMNTOOLS'] + 'VsDevCmd.bat'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1432f6fed877c14 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:327

                    (script_path, os.environ['VSCMD_ARG_TGT_ARCH'], os.environ['VSCMD_ARG_HOST_ARCH'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #173daa921e145439 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:426

        with open(sln_filename_tmp, 'w', encoding='utf-8-sig') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f194ed5aa42f9a19 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:1008

        with open(ofname_tmp, 'w', encoding='utf-8') as of:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c44465db77b13459 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:2110

            with open(rulefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ddc495ce8957b13 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2017backend.py:44

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dca4789a778f9e02 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2019backend.py:39

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3338002ef020252a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2022backend.py:39

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #902c600dd7980394 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2026backend.py:39

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbac0734f61bf1fb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/xcodebackend.py:274

        with open(tmpname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbdf2ff0b2b35ea3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/build.py:3601

        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bd5e2d444db76c9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cargo/toml.py:41

            with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #160584e504c7b78e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/executor.py:216

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7435c281cf3b964e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:51

        query_file.write_text(json.dumps(query, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f82611bdf1c4e38 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:75

        debug_json.write_text(json.dumps(index, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0bb1ee3cfa701cd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:320

        data = json.loads(real_path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #709f5ec3b4c7cbe3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/interpreter.py:884

            os_env = environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a84235d39b29d0b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:61

        self.toolchain_file.write_text(self.generate(), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7297cec98b5a2b8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:62

        self.cmcache_file.write_text(self.generate_cache(), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89cdc3dc70e0abea — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:238

        cmake_file.write_text(cmake_content, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3b83f5bd600dd4b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:242

        temp_toolchain_file.write_text(CMakeToolchain._print_vars(self.variables), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2e799abe14d871a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/traceparser.py:170

            trace = self.trace_file_path.read_text(errors='ignore', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a6c7701458d034d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmdline.py:93

    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e6f2c1b30c199ac — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmdline.py:112

    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ecfc391a2ef8282a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:866

                with open(srcname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1932d00df2fb0f58 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:907

            os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47bc289e9ced2c05 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:1277

        with open(os.path.join(work_dir, sourcename), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0633a0a6bf4f8634 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:308

            if 'WATCOM' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09ab045ca9b1cf9e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:312

                watcom_cls = [sanitize(os.path.join(os.environ['WATCOM'], 'BINNT', 'cl')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f05e1cd7d9acab30 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:313

                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT', 'cl.exe')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a43fc5c16f353d75 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:314

                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT64', 'cl')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df8214b966f5173a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:315

                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT64', 'cl.exe'))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd3c729692f42feb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:1355

            default_path = os.path.join(os.environ['ProgramFiles'], 'NASM')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4db7b21610e55c0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:228

                    with open(file_to_check, 'rb') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33e3f183aefde008 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:881

            with open(p.output_name, 'rb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc1ce4dc09d922e2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:1197

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3182021f328fb412 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:42

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd5846e39ce8afa2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:53

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04d07c3739426da8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:65

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19420dfb0ada01cb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/gnu.py:323

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #560d618d07f11d6f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/visualstudio.py:316

        if 'INCLUDE' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bb174255246e679 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/visualstudio.py:318

        return os.environ['INCLUDE'].split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3ba24c5fba2aed7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:292

                    with open(f, encoding='utf-8') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #476ee3cb2f84d72c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:293

                        with open(fcopy, 'w', encoding='utf-8') as wf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ea6cdc92bd20824 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:303

                    os.environ.get('XDG_DATA_HOME', os.path.expanduser('~/.local/share')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f287a780a31970c6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:304

                ] + os.environ.get('XDG_DATA_DIRS', '/usr/local/share:/usr/share').split(':')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43147b0a2b79a658 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:489

    with open(tempfilename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f60eed9c816abf74 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:784

        deploy_target = os.environ.get('MACOSX_DEPLOYMENT_TARGET', macos_version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1eedc8031f75891 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:800

        deploy_target = os.environ.get('IPHONEOS_DEPLOYMENT_TARGET', ios_version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5a1dd85e1ae39ce — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:939

        _m = os.environ.get('MKLROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8067f3f37284da11 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/boost.py:762

        raw = hfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #924f5c4c5c31a441 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:298

        for i in os.environ.get('PATH', '').split(os.pathsep):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f89699fda8e812e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:329

        env_path = os.environ.get(f'{name}_DIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97d7a04bf96bd574 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:580

        cmake_txt = importlib.resources.read_text('mesonbuild.dependencies.data', cmake_file, encoding = 'utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e9a91f367d5cf13 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:600

        cm_file.write_text(cmake_txt, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9d2a2842ccb98dc — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:175

        env_vars = [var for var in env_vars if var in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2fdf01270ccc29be — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:176

        user_defaults = {os.environ[var] for var in env_vars}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8834a6de9c45579b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:182

        return ([(os.environ[self.env_var], True)] if self.env_var else []) \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5ee087a9c185774 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:186

        env_vars = os.environ.keys()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9708c87a951415be — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:187

        return [(os.environ[var], False) for var in env_vars if var.startswith('CUDA_PATH_')]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2fa53801fbff385 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:223

            raw = i.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #70ba4a38a6140205 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:241

            with open(version_file_path, encoding='utf-8') as version_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53325663a00c28ee — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/dev.py:777

        vsdir = os.environ.get('VSInstallDir')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb380b7e791a366e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:110

            os.environ[f'HDF5_{cenv}'] = join_args(compiler.get_exelist())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b53279cedf6c9b21 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:111

            os.environ[f'HDF5_{lenv}LINKER'] = join_args(compiler.get_linker_exelist())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aff28d91224f5f53 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:114

            del os.environ[f'HDF5_{cenv}']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64b50d9372ef505d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:115

            del os.environ[f'HDF5_{lenv}LINKER']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d67fe9f98fdb52d9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:54

        tool_names = [os.environ.get(env_name) for env_name in env_vars]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15d26c9d1ed35c19 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:244

        incdir = os.environ.get('MSMPI_INC')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b250ba3a62d15153 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:248

            libdir = os.environ.get('MSMPI_LIB32')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d0520343c5a43ece — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:251

            libdir = os.environ.get('MSMPI_LIB64')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #214781172745fffd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:278

        rootdir = os.environ.get('I_MPI_ROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ecab6ed614ad4b1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:164

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ef218a10e32b1c0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:181

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43e988a5a173bb2c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:302

        env = env or os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f37a45b67a61eb07 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:560

        with open(la_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b4c40e877643b8c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/python.py:98

            self._data = json.loads(self._path.read_text(encoding='utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f552212d439f4961 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/python.py:229

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e7ec42b1d84f075 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/scalapack.py:57

        _m = os.environ.get('MKLROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e29a1b358530d85 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/ui.py:119

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64a49eb19b3a48ed — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/ui.py:185

        self.vulkan_sdk = os.environ.get('VULKAN_SDK', os.environ.get('VK_SDK_PATH'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8657bdb6fcf949aa — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/envconfig.py:725

    return os.environ.get('MSYSTEM_CARCH', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d5433d7a196259a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/environment.py:70

        value = os.environ.get(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57eaa4214895d236 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:385

        if 'MESON_UNIT_TEST' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8388bdec04c28c1e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:387

        if 'MESON_RUNNING_IN_PROJECT_TESTS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #292f8b54c67aa1e5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:967

        with open(meson_filename, "w", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13eb6062af796855 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:1250

                ver_data = Path(ifname).read_text(encoding='utf-8').split('\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #772ac6e48d2cb15c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:2814

                with open(dst_tmp, 'w', encoding=file_encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78690e4011a7e68d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:2821

                with open(depfile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25768bc0753a5a7c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreterobjects.py:264

        child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #846009e92cc2aad6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106

            with open(fname, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fc19bc61aa57840 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155

                    with open(parent / 'meson.build', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #511f603826b7a88d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676

            with open(option_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ce96e0abb6928df — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/machinefile.py:30

                with open(fname, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf0a99fbe2948eb0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mcompile.py:253

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f65fb39949708406 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mconf.py:95

                    with open(opfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #700e6ea21829ae42 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mconf.py:110

                        with open(opfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2dc9c42c4ef9ce9c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:72

    env = {} if dump_fmt else os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71b86216e1b39fc8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:153

            gdbinit_path.write_text(gdbinit_line, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f1b01f835c3817d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:199

            with open(options.dump, "w", encoding='utf-8') as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18255a4635e39284 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:217

        if os.environ.get("MESON_DISABLE_PS1_OVERRIDE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e39ea4f82bcc700 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:219

        shell_env = os.environ.get("SHELL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #418ac6f3e94ea92f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:233

                args = [os.environ.get("COMSPEC", r"C:\WINDOWS\system32\cmd.exe")]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51b125364b911246 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:236

            args = [os.environ.get("SHELL", os.path.realpath("/bin/sh"))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #244e30fbda460d3b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:263

            with open(os.path.join(tmpdir.name, '.zshrc'), 'w') as zshrc: # pylint: disable=unspecified-encoding

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6cf26c75ce487b67 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:68

    m.update(open(fname, 'rb').read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cac12e2bace11f94 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:69

    with open(hashname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25d7fc1287abb3a2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:96

            if 'GITLAB_CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da1dbc895dfd12fb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:261

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d622326f9a1532df — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:294

            with lzma.open(xzname, 'wb') as xf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #131576313ded076a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:299

            with bz2.open(bz2name, 'wb') as bf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdf4807f1ac3c7fa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:304

            with gzip.open(gzname, 'wb') as zf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ebbffe1c1553cb8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:324

    myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55ba740068b632bb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesondata.py:21

            data = importlib.resources.read_text( # [ignore encoding] it's on the next lines, Mr. Lint
                    ('mesonbuild' / self.path.parent).as_posix().replace('/', '.'),
                    self.path.name,
                    encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c8ae7a6cf948fa9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesondata.py:25

            path.write_text(data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf048fdd04739cbd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:33

        if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe9362054aab9e06 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:43

        if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffa45cda09017a17 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:257

    if os.environ.get('MESON_SHOW_DEPRECATIONS'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ed2998ef6b1dcc5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:264

    if sys.version_info >= (3, 10) and os.environ.get('MESON_RUNNING_IN_PROJECT_TESTS'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fb80a75ba895709 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:282

    if sys.platform == 'cygwin' and os.environ.get('MSYSTEM', '') not in ['MSYS', '']:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8c92ac521390080 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mformat.py:38

            self.read_string(f'[{self.default_section}]\n' + filename.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1aee7b9a839b7edf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mformat.py:1089

                code = src_file.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b55d8afaeda25a4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:545

            destdir = os.environ.get('DESTDIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81f23c9cf311d371 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:551

            os.environ['DESTDIR'] = destdir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b9370ac8b080a58 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:581

                os.environ.get('MESON_ROOT_CMD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b21e42323085288 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:587

            if rootcmd is None and pkexec is not None and 'PKEXEC_UID' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26164cd65d97bfe1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:814

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54fb84b440674f40 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:816

            if os.environ.get('SUDO_USER') is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c0085026c4a776b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:825

            elif os.environ.get('DOAS_USER') is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f632664c9442c09e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:879

    with open(os.path.join(log_dir, 'install-log.txt'), 'w', encoding='utf-8') as lf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e64d96e4b07bb5e4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:511

    with open(get_info_file(infodir, kind), encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5adc37e7ac76f5c7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:580

        with open(tmp_file, 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1c643be3b3fdaa1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:650

    with open(tmp_file, 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #296177174de28377 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:50

    return bool(kernel.SetConsoleMode(stdout, mode.value | 0x4) or os.environ.get('ANSICON'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5648a92e6d81fdd7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:52

_in_ci = 'CI' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ca67c1622d1108f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:53

_ci_is_github = 'GITHUB_ACTIONS' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1db405b676184d68 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:128

        if 'PAGER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca710831c6c6cb3d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:129

            pager_cmd = shlex.split(os.environ['PAGER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #acbe917f2f5cb11e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:148

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd016aebff55df08 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:158

            if 'PAGER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc699d9fbeb1a2d2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:174

        self.log_file = open(os.path.join(logdir, self._LOG_FNAME), 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9d1bc8df9c19128 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:175

        self.slog_file = open(os.path.join(logdir, self._SLOG_FNAME), 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #783b7b1e2bb6535f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:406

                _colorize_console = os.isatty(output.fileno()) and os.environ.get('TERM', 'dumb') != 'dumb'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fb1ce3d006d6883 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:582

    elif 'MESON_FORCE_SHOW_LOGS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57cbe0613fd3c0de — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:589

    with open(fname, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f7ab2e24214b109 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/_qt.py:817

        with open(fileout_abs, 'w', encoding='utf-8') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cd59cce72479719 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/cmake.py:338

            with open(infile, encoding='utf-8') as fin:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #392425665b5a8325 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/cmake.py:352

        with open(outfile_tmp, "w", encoding='utf-8') as fout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d28e391739d09c18 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/dlang.py:74

            with open(config_path, encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fd15c8ac8e825ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/dlang.py:115

        with open(config_path, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9094a5f3bfbadad2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/external_project.py:155

        self.run_env: EnvironOrDict = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbfcf450cccc1228 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/external_project.py:220

            output = open(logfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09eaf8bad95ca06d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/features/module.py:680

        with open(config_path, "w", encoding='utf-8') as cout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da65215b6e93acee — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/fs.py:169

        with open(file, mode='rb', buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3012fdc5aafa4898 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/fs.py:268

            with open(path, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #abb64494b72e33c2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/gnome.py:950

        with open(gir_filelist_filename, 'w', encoding='utf-8') as gir_filelist:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa6953e8770fa700 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/gnome.py:2212

        with open(fname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dce4bfe3fcb0f6c8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/hotdoc.py:293

        with open(hotdoc_config_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b75e039055aaf37 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/i18n.py:238

        rsp_file.write_text(source_list, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61e3116be4742437 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/keyval.py:31

            with open(path_to_config, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c102b14ac151450f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/pkgconfig.py:555

        with open(fname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bebc25660276802 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/python.py:431

        with open(pycompile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a677b15bef24d34 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/python.py:442

                with open(os.path.join(self.interpreter.environment.get_scratch_dir(), manifest), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4665f5ff676e538 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/snippets.py:100

        header_path.write_text(content, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d698d5feee1a5e53 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mparser.py:113

        self.in_unit_test = 'MESON_RUNNING_IN_PROJECT_TESTS' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9da67db09b64fdab — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:152

        with open(os.path.join(build_dir, '.gitignore'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c05d3ed05c2525c6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:154

        with open(os.path.join(build_dir, '.hgignore'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd2ab539df1b03b5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:324

                with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af9aa320f01a31e6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:527

        self.file = open(filename, 'w', encoding='utf-8', errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2769792ccbc4099 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:762

        inherit_env = env_tuple_to_str(os.environ.items())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f41a65f2d0d852b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:956

        with open(self.filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28f7207eafe8ba10 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1057

        test_only_env = set(self.env.items()) - set(os.environ.items())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea2d3d157abb4e67 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1121

            with open(filename, 'r', encoding='utf8', errors='replace') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45da77a114aaa696 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1794

        return current.env.get_env(os.environ.copy())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03b6d0721d61a413 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1802

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c6f8ca65134b94c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:2237

        with open(targets_file, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78587bd64b666c25 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:2319

            if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93090866e967ade6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/optinterpreter.py:83

            with open(option_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9df4bb000c51d4a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:185

        if 'USERPROFILE' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c8e2423c50ce9ff6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:196

        appstore_dir = Path(os.environ['USERPROFILE']) / 'AppData' / 'Local' / 'Microsoft' / 'WindowsApps'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ab3f604904b430b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:228

            with open(script, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b3da61bd3ea57f2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:332

        search_dirs = OrderedSet(self._windows_sanitize_path(os.environ.get('PATH', '')).split(';'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14de41d8e2a65f1b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:354

        path = os.environ.get('PATH', os.defpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90d4b7a011479f99 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1022

                with open(fpath, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a79bd956212385cf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1024

            with open(fpath, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7044b0de1812339 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1075

            with open(val['path'], 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6538b185cff810a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1144

        with open(options.json, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f60645aa334d1e02 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/clangformat.py:26

            original = fname.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a1f3e1b3f8bc1448 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/cleantrees.py:30

    with open(args[0], 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #589dd6bce569cc1f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/coverage.py:103

                    with open(llvm_cov_shim_path, 'w', encoding='utf-8') as llvm_cov_bat:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #377eba67fd830cb9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/coverage.py:107

                    with open(llvm_cov_shim_path, 'w', encoding='utf-8') as llvm_cov_sh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1b9e8aa6eb2c4415 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:105

    with open(outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #37ff9a1ff8907707 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:119

    with open(jsonfile, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #221a77acd613929b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:125

        with open(dep, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d827f8a954ffc159 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:159

            self.bf = open(bfile, 'r+b')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #caf2c540c8cebe31 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:164

                self.bf = open(bfile, 'r+b')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #18a68950ee45ec41 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:523

    with open('META-INF/MANIFEST.MF', 'r+', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7534bfcab19301b4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:72

        with open(pickle_file, 'rb') as pf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0dbd1d752f38101f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:90

        for line in fpath.read_text(encoding='utf-8-sig', errors='ignore').split('\n'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #59b17953e3cde6e3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:134

        for line in fpath.read_text(encoding='utf-8-sig', errors='ignore').split('\n'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0bcd7da7e9a2a004 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:199

        with open(self.outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #27eabf28d4718940 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:100

    cppflags = shlex.split(os.environ.get('CPPFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b11bcebcde669205 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:101

    cflags = shlex.split(os.environ.get('CFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #48ffb63f81673413 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:102

    cxxflags = shlex.split(os.environ.get('CXXFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #472b8f6249395613 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:103

    objcflags = shlex.split(os.environ.get('OBJCFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #acdf5bc42198ece0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:104

    objcxxflags = shlex.split(os.environ.get('OBJCXXFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6cf9c6db9deb2b21 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:105

    ldflags = shlex.split(os.environ.get('LDFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #10b0569f4d140340 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:278

    with open(tmpfilename, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #dc85f1e15588484a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:329

        compile_args = shlex.split(os.environ.get(compilers.CFLAGS_MAPPING[langname] + envvar_suffix, ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0dde7db8ba509eb5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:331

        cppflags = tuple(shlex.split(os.environ.get('CPPFLAGS' + envvar_suffix, '')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7814dc2840273fb5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:337

        lang_link_args += shlex.split(os.environ.get('LDFLAGS' + envvar_suffix, ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d728d4f0ec55b929 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:345

            compilerstr = os.environ.get(envvarname + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b07516d3aaa715f3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:365

            binstr = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c647b2a3918564fb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:371

    var = os.environ.get('PKG_CONFIG_LIBDIR' + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7cf461495c8a16b1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:374

    var = os.environ.get('PKG_CONFIG_SYSROOT_DIR' + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #654159e6db5760c0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:523

            with open(pathlib.Path(self.options.outfile) / crossfile_name, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #797fe62b0b6523e3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:28

        with open(self.depfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #20b8a4e93e039bb3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:39

        with open(self.stampfile, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2d7e652a2e50ca25 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:74

            output = open(logfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6672c493073612cf — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:79

        run_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8f85fc9ccfba8980 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gettext.py:30

        with open(linguas, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #779909fb01565884 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gettext.py:48

    child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #737dcfe3f774ee55 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:52

    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #625edf4a14a91f97 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:270

    if 'MESON_INSTALL_PREFIX' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cbc9b7fb3a6ea951 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:271

        destdir = os.environ.get('DESTDIR', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c5cf31a9d023fa5b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:272

        install_prefix = destdir_join(destdir, os.environ['MESON_INSTALL_PREFIX'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #85efc35fda8ca3d2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/hotdochelper.py:23

    subenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4622410dd26c3356 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/hotdochelper.py:35

        destdir = os.environ.get('DESTDIR', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #af121c508377b6f1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/itstool.py:64

    build_dir = os.environ.get('MESON_BUILD_ROOT', os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #01719e66e5a86b78 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:31

    child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6e74afff24cf178c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:49

        stdin = open(exe.feed, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #98e415d6f2321de5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:84

            with open(exe.capture, 'rb') as cur:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #083789ef34fe60f0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:89

            with open(exe.capture, 'wb') as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c9896a6cfdafca71 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:106

        with open(options.unpickle, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a46c634bb17f0e96 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/msgfmthelper.py:25

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2d5ce186e6523fdd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pickle_env.py:6

    with open(args[0], "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9aaad33f08a4c71d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pickle_env.py:7

        pickle.dump(dict(os.environ), f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #52338e57dbc7b1f7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:12

quiet = int(os.environ.get('MESON_INSTALL_QUIET', 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5f545f2dfada996c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:22

        fullpath = absf = os.environ['MESON_INSTALL_DESTDIR_'+key] + f

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e11f6da5ca141925 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:23

        f = os.environ['MESON_INSTALL_'+key] + f

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d32f9989e1b9c921 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:41

    with open(data_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #345f4431ed9a8566 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/regen_checker.py:41

    with open(dumpfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b91cfe739addd3dd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/regen_checker.py:44

    with open(coredata_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #31a3e22d3c66945d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/reprotest.py:61

        os.environ['CCACHE_DISABLE'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6d4590d1c09e70f9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/run_tool.py:136

    with open('meson-info/intro-targets.json', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8fc8eccd62a3d872 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/run_tool.py:156

    with open('meson-info/intro-targets.json', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #66e6452abcefc1ff — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/rustdoc.py:57

                environ = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #af662918f044a1d0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:31

    with open(outfilename, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #82bcc82f9ea59111 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:36

        with open(outfilename, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #38c823fe825de9ae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:42

    with open(outfilename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #78f184f92b6bd214 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:53

    with open(TOOL_WARNING_FILE, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c5f7102bf4bf6f72 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:58

    if evar in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #10c8dc7a3d58503f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:60

        return shlex.split(os.environ[evar])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #37da0016d88c44ad — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:118

    origpath = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #efc2db4cc8580062 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:120

        os.environ['PATH'] = '/usr/gnu/bin:' + origpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4f5c4b691d7a15eb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:123

        os.environ['PATH'] = origpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #57a9bafec809fcf1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:228

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #853ce4894225e717 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:333

            with open(TOOL_WARNING_FILE, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #99427223a396d5da — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/uninstall.py:14

    for line in open(log, encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #37ae294828ef351b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:16

    with open(infile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a5ff6e8b19e34a29 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:19

        with open(outfile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #38b3bcad55918421 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:24

        with open(outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b12556394dcb49a8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/yasm.py:21

    with open(options.depfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42ca59e08febf07f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:96

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc08c3ea635c3386 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:100

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67b2eb14fcd1f53e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:128

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f680cbe9084f195 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:131

            with open(test_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #262b0518b6c1f7ca — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:134

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3393150987e82955 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:148

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bd8a6bc1a246fe7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:151

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98af793ce2c517a2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:188

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5d680f468060b78 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:191

            with open(test_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be4832fbbf1d533e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:194

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3672e579d6afdac7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:219

            with open(kwargs['header_file'], 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3daf7312fbf1c220 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:106

    env_ninja = os.environ.get('NINJA', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c74424a24403969f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:193

    if 'SCANBUILD' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbd7f3c0c13b6229 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:194

        exelist = split_args(os.environ['SCANBUILD'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2efaddd262d5af7b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/platform.py:49

                self.lockfile = open(self.lockpath, 'w+', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35cc15f213e73535 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/platform.py:98

                self.lockfile = open(self.lockpath, 'w+', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d49274328056c5ab — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:247

    if 'MESON_COMMAND_TESTS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #443d7417ed920e3b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:752

    arch = os.environ.get('PROCESSOR_ARCHITEW6432', '').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8db7d43196a27b7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:756

            arch = os.environ['PROCESSOR_ARCHITECTURE'].lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d9e712fedf78777 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:836

    vsver = os.environ.get('VSCMD_VER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec40da1510285c86 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1124

        if varname in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa7b87c48af1b6b1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1126

                num_workers = int(os.environ[varname])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #913368c6f1c57649 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1543

        with open(src, encoding=encoding, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2a4a7643fc6e31f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1551

        with open(dst_tmp, 'w', encoding=encoding, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #acd04ee2b9939752 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1612

    with open(ofilename_tmp, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a2dfba6081aae13 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1627

        with open(dst, 'rb') as f1, open(dst_tmp, 'rb') as f2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b179b5e81d0bdc28 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1717

            with open(args_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2d0d62f47226da6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:2429

        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #870bd893f7bf2cb6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:2490

    return int(os.environ.get('MESON_RSP_THRESHOLD', limit))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8bd39910fb419182 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:31

    if os.environ.get('OSTYPE') == 'cygwin':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1d29a9804465b63 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:33

    if 'MESON_FORCE_VSENV_FOR_UNITTEST' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #160de9bf14526b29 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:36

        if 'VSINSTALLDIR' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3feafb72e6728db — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:51

    root = os.environ.get("ProgramFiles(x86)") or os.environ.get("ProgramFiles")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #135ee4e5e1a920d2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:98

        with open(env_file.name, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #069662496d7f9ab2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:101

            os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8aed15cf4dbda31b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:121

        return T.cast('http.client.HTTPResponse', urllib.request.urlopen(req, timeout=REQ_TIMEOUT, context=ssl_truststore()))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8b942cc6dc51d65d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:172

    with open(wrapfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba1eaaf0a4dac7a3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:285

        with open(filename, 'r', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #447736930efd94bc — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:344

            with open(self.get_hashfile(subproject_directory), 'w', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af8b3bc5fc109339 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:378

        self.cachedir = os.environ.get('MESON_PACKAGE_CACHE_DIR') or os.path.join(self.subdir_root, 'packagecache')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca99951181632438 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:539

                with open(main_fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cceb82a513ac75b4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:730

            with open(hashfile, 'r', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #5b89bdefadf1d388 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:822

                resp = urllib.request.urlopen(req, timeout=REQ_TIMEOUT, context=ssl_truststore())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #0c7bba7667d8b6e7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:861

        with open(path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #606e33b7a339261f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wraptool.py:102

    with open(wrapfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12b4f5bbd2e2ddc2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wraptool.py:207

    with open(os.path.join(subproject_dir_name, 'wrapdb.json'), 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2155c08031c8ce87 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:234

        with open(self.main_xml, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d1412653da60944b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:237

        with open(self.main_xml) as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3c2b507ff0ba060 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:240

        with open(self.main_xml, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a98c1ce5023d2ac9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createpkg.py:94

        with open(self.distribution_file, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7eee3835e5ed3091 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:42

version_lines = pathlib.Path(relfile).read_text().split('\n')[:-1]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74dc8140f18795db — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:59

    myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #215288999a14efde — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:62

    pathlib.Path(relfile).write_text('\n'.join(version_lines) + '\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #acf26cee94e3db90 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_cross_test.py:40

        data = json.loads(cf_path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6e16d851bb3e1c01 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_cross_test.py:43

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a12cd397e55ba2b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_format_tests.py:19

    lines = file.read_bytes().split(b'\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d220855813dce7d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:62

        self.orig_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14cfaddaa56b085a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:64

        os.environ['MESON_COMMAND_TESTS'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b04e36cae2c4560 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:75

        os.environ.clear()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd3409647af6bc48 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:76

        os.environ.update(self.orig_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c68aa21b0471b401 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:133

        os.environ['PATH'] = str(bindir) + os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed7745f7b7a55d96 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:151

        os.environ['PYTHONPATH'] = os.path.join(str(pylibdir), '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1f5b3c246b54689 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:152

        os.environ['PATH'] = str(bindir) + os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c58578d5804d657f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:163

            os.environ['PYTHONPATH'] = os.pathsep.join(PYTHONPATHS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #530f3baeac40b0b3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:196

        wrapper.write_text('#!/bin/sh\n\nmeson.real "$@"', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3b6f3b23bf72ff3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:219

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a5fd07968caac45 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:221

        with open(script_file, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #242671f6a03eca26 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_mypy.py:170

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0e7ad2c4700ca62 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:278

        self.env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d0a60cfd5008b7f1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:310

print_debug = 'MESON_PRINT_TEST_OUTPUT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4c4c9ca5e10a849 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:311

under_ci = 'CI' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c311e649620edf0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:312

raw_ci_jobname = os.environ.get('MESON_CI_JOBNAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6915766e671cebed — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:826

            if skip_env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #728da0b4bf9e217d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:837

        test_def = json.loads(test_def_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ffcdcb9961dd00b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1042

    skip_cmake = ((os.environ.get('compiler') == 'msvc2015' and under_ci) or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df09115d586fca7b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1099

    with open(txtname, 'w', encoding='utf-8', errors='ignore') as lf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fcf30907a1ef7570 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1636

    if 'VSCMD_VER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf27a947c7842353 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1637

        print('VSCMD version', os.environ['VSCMD_VER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58230c453af9ad53 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:52

    NINJA_1_12_OR_NEWER = bool(int(os.environ['NINJA_1_12_OR_NEWER']))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30df390a6847e328 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:53

    NINJA_CMD = [os.environ['NINJA']]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff2b744ac8b3e5ad — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:63

    os.environ['NINJA_1_12_OR_NEWER'] = str(int(NINJA_1_12_OR_NEWER))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15c0fef51e86af5b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:64

    os.environ['NINJA'] = NINJA_CMD[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27aedff0782c66d2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:72

os.environ['PYTHONWARNDEFAULTENCODING'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9df7c1f1f314c2d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:74

os.environ['MESON_RUNNING_IN_PROJECT_TESTS'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ee2d40f1422011c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:118

    if not os.environ.get('MKLROOT', '').strip():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80b38f4a75d32c3e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:120

    if (os.environ.get('CC') == 'icl' or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46107468a1b5c4ae — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:121

            os.environ.get('CXX') == 'icl' or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9561dff59df2618c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:122

            os.environ.get('FC') == 'ifort'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #343d49437b87da39 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:131

                 'Please try using the Intel shell.'.format(os.environ.get('MKLROOT')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc29ffcb78955f15 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:173

if 'MESON_EXE' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6e4776d7d118745 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:174

    meson_exe = mesonlib.split_args(os.environ['MESON_EXE'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d132864e1423908 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:233

            with open(f, encoding='utf-8') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #684aea4b21e9c6cd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:301

    with mock.patch.dict(os.environ, env or {}), mock.patch.object(sys, 'stdout', stdout), mock.patch.object(sys, 'stderr', stderr):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36329a895a6d2dd0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:352

    if not mesonlib.is_windows() and not mesonlib.is_haiku() and 'CI' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3acdebb232c87d70 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:366

    if 'APPVEYOR' in os.environ and os.environ['arch'] == 'x86':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b157c7ded4b422a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:367

        os.environ.pop('platform')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bfc916d5df9ebfd9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:370

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a3f9f5bcb3a5f8c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_unittests.py:69

    os.environ['MESON_UNIT_TEST_BACKEND'] = be

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b97dd919a3d6a04 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_unittests.py:113

        if 'CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b78890b690b357f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:13

    if is_pr_env not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5ba3ef74c2d8697 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:16

    elif os.environ[is_pr_env] == 'false':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad5cefbec6f00e61 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:22

    if base_env not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6d1a073eb554363 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:25

    return os.environ[base_env]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55c06c7470567399 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cmake/11 cmake_module_path/subprojects/cmMod/gen.py:1

with open('main.c', 'w') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1323117f8c8b6edc — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:12

input_file = os.path.join(os.environ['MESON_SOURCE_ROOT'], 'raw.dat')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #325973b71efc1567 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:13

output_file = os.path.join(os.environ['MESON_BUILD_ROOT'], 'generated.h')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68f11db608573eae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:15

with open(input_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca8f52a7e934b466 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:17

with open(output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7db0086472f0577 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8

with open(output, 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4db7141b04986ed7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:11

        with open(i) as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2fd14ad4cf75738 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen-resx.py:8

with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1c1d3491699508f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen.py:8

with open(ifile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb034b865aba6ec1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen.py:12

with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9f51610f319c646 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/109 custom target capture/my_compiler.py:9

    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e475483b9917385e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/110 allgenerate/converter.py:8

open(ofile, 'w').write(open(ifile).read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10a0f7c631b8cc6a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/123 custom target directory install/docgen.py:14

    with open(os.path.join(out, name + '.html'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3b484850459e8fb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/125 configure file in generator/src/gen.py:8

with open(ifile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eed6549ea9da1e37 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/125 configure file in generator/src/gen.py:12

with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5aaf20b2827218ec — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/128 build by default targets in tests/write_file.py:5

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ec647625aec53f1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5

ifile = open(sys.argv[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5633f8594bb37d3e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6

ofile = open(sys.argv[2], 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24b08d26f80e4b44 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_custom.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d7d2523b28db4f6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_generator.py:4

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e4ab9f818336d18 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_generator.py:6

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #941dfa9b3e7e3e01 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_env.py:12

if 'MESONINTROSPECT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7ad2655a04d3f0b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_env.py:15

mesonintrospect = os.environ['MESONINTROSPECT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c8c26628a06d465 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:8

if 'MESONINTROSPECT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3593cdecf992e116 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:10

if 'MESON_BUILD_ROOT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b89b6ede1173f6f5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:13

mesonintrospect = os.environ['MESONINTROSPECT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ef80ac8cfb665f6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:16

buildroot = os.environ['MESON_BUILD_ROOT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ce2e83c36e298e6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/file_contains.py:14

    with open(args.file[0], encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c6c19523753dd55 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-deps.py:9

build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #130c6a31709564b4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-deps.py:10

subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1cf4fd0cc9a61a8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-without-input-file.py:9

build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9d3d909b2dac62f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-without-input-file.py:10

subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1cf7752d9066e1ab — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator.py:9

build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8af4132b0474d62 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator.py:10

subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88cdd445e74fafbf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/140 custom target multiple outputs/generator.py:11

with open(os.path.join(odir, name + '.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e63c2965316b47e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/140 custom target multiple outputs/generator.py:13

with open(os.path.join(odir, name + '.sh'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09dfe4c942ae866f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/141 special characters/check_quoting.py:27

    with open(output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4569654c410336a5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/144 link depends custom target/make_file.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf32b5e89f387c04 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/152 index customtarget/gen_sources.py:30

    with open(args.header, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #580046009246b456 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/152 index customtarget/gen_sources.py:33

    with open(args.code, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f564d5a5c6fffe1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:41

    proto_name = open(ifile_name).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f0e368aa543ffaa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:45

    open(h_out, 'w').write(h_templ % (proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f834d2add7cc943 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:46

    open(c_out, 'w').write(c_templ % (proto_name, proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #748146efbeaaf932 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/169 source in dep/generated/genheader.py:15

funname = open(ifile).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bf2b2f2eb84f471 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/169 source in dep/generated/genheader.py:17

open(ofile, 'w').write(templ % funname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6034247b82475149 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/170 generator link whole/generator.py:14

    with open(hname, 'w') as hfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5356435edb700cb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/170 generator link whole/generator.py:20

    with open(cname, 'w') as cfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #388a6fbd3fb596b2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/178 bothlibraries/dummy.py:7

    Path(sys.argv[1]).write_text('Hello World\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #111ffe4cfb838383 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/179 escape and unicode/file.py:6

with open(sys.argv[1]) as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #155225a04fa8f521 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/179 escape and unicode/file.py:9

with open(os.path.join(sys.argv[3]), 'w', errors='replace') as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff070e403dd6859e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/182 find override/subdir/converter.py:13

d = pathlib.Path(ifilename).read_text().split('\n')[0].strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #706a2a479d578615 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/182 find override/subdir/converter.py:15

pathlib.Path(ofilename).write_text(ftempl % d)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce42e6ba9904e0e1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/186 test depends/gen.py:7

    with open(sys.argv[1], 'w') as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afb1b09758bc471c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:41

    proto_name = open(ifile_name).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #022e9debf21a04f4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:45

    open(h_out, 'w').write(h_templ % (proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #339378dd75a7e0f6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:46

    open(c_out, 'w').write(c_templ % (proto_name, proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23b0916430cc011d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/202 custom target build by default/docgen.py:11

    with open(os.path.join(out, name + '.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84a182b78b08823e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/208 link custom/custom_stlib.py:73

    c_file.write_text(contents)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #351be6f14064b78a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/209 link custom_i single from multiple/generate_conflicting_stlibs.py:70

        c_file.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2088e81ed32662b3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/210 link custom_i multiple from multiple/generate_stlibs.py:72

        c_file.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4edf7e134e9601ae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/216 custom target input extracted objects/check_object.py:16

    with open(sys.argv[2], 'wb') as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4fa65c61d3574c1e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/216 custom target input extracted objects/libdir/gen.py:3

with open(sys.argv[1], 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c13a4db09365714 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/22 object extraction/check-obj.py:12

    with open('compile_commands.json') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ec4be0d35468edd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/check_arch.py:12

with open(dummy_output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #955e7cff375a88b4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/make_file.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddbcf8e116d2138b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/make_file.py:7

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7dbc36419309a740 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/227 very long command line/codegen.py:6

Path(sys.argv[2]).write_text(
    'int func{n}(void) {{ return {n}; }}'.format(n=sys.argv[1]))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9360cce9d1bd05da — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2

with open('x.c', 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #139169cdc21f27c0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4

with open('y', 'w'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6599b72556a8f478 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/242 custom target feed/my_compiler.py:13

    with open(sys.argv[1], 'w+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #743114c7d66822a3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5

assert(Path(sys.argv[1]).read_text() == 'stage1\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a96c50ed26f5ae9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6

Path(sys.argv[2]).write_text('stage2\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7daa6d3fa71db37 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5

assert(Path(sys.argv[1]).read_text() == 'stage2\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31cbf6d2b618b530 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6

Path(sys.argv[2]).write_text('int main(void){}\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d1b0edce456310fd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/269 configure file output format/compare.py:3

with open(sys.argv[1], 'r', encoding='utf-8') as f, open(sys.argv[2], 'r', encoding='utf-8') as g:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3df7c1979fdcd49f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:5

ENV_VAR_VALUE = os.environ.get('ENV_VAR_VALUE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f84d3f4a2c07a98 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:8

with open(sys.argv[1], 'r') as infile, \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5fdeeaef15d3818 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:9

     open(sys.argv[2], 'w') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9af85ac864f202b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/274 customtarget exe for test/generate.py:12

    with open(a, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56304e2bc4b13797 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/275 environment/testenv.py:9

if os.environ.get(key) == expected:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8df11ac918a0fc7e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/275 environment/testenv.py:12

sys.exit(f'Expected {expected!r}, was {os.environ.get(key)!r}')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4be8b5630b82745 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/33 run program/check-env.py:5

assert os.environ['MY_PATH'] == os.pathsep.join(['0', '1', '2'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eac39387cdc15a54 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:6

assert os.environ['MESONTESTING'] == 'picklerror'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5053ea83bdd7cce3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:7

assert os.environ['TEST_LIST_FLATTENING'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff310fa05b578df6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11dff6e04f6157c3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/depfile/dep.py:12

with open(output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d12db8e67242a889 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/depfile/dep.py:14

with open(depfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc6e93add47b0d5f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:11

    assert os.environ['MY_COMPILER_ENV'] == 'value'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95329ef323daf9e1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:16

    with open(args[1].split('=', 1)[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77b82c6a84c7a0e3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:21

    with open(args[2].split('=', 1)[1], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f3ab2e5dd47ca0f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler.py:9

    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c8025c8b8274fb74 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler.py:14

    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b563d27464fc5b8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler2.py:9

    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3ef514db6143924 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler2.py:14

    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ecfcde7af0a59ba0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/usetarget/subcomp.py:5

with open(sys.argv[1], 'rb') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f814ce32b9e18a15 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/usetarget/subcomp.py:6

    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc45218986c05e45 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:6

assert 'MESON_SOURCE_ROOT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f274dd235dfb860e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:7

assert 'MESON_BUILD_ROOT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0da332e534753366 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:8

assert 'MESON_SUBDIR' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f196df2ec837a3b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:9

assert 'MESONINTROSPECT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fa930cadb2e5633 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:10

assert 'MY_ENV' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f0e781716553ae6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:15

env_source_root = Path(os.environ['MESON_SOURCE_ROOT']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #307d83c397e14b1d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:16

env_build_root = Path(os.environ['MESON_BUILD_ROOT']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f31e758d384d6bd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:17

env_current_source_dir = Path(env_source_root, os.environ['MESON_SUBDIR']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #134318c70ae61a78 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/converter.py:5

with open(sys.argv[1], 'rb') as ifile, open(sys.argv[2], 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4b2f454790e2748 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/fakeburner.py:9

    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f577331e14bd728 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/customtarget.py:12

    with open(os.path.join(args.dirname, '1.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d0215e635909ade — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/customtarget.py:14

    with open(os.path.join(args.dirname, '2.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56c339c7aacc7d4f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:7

prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ff8285460b18bd9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:8

dry_run = bool(os.environ.get('MESON_INSTALL_DRY_RUN'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89d9c5d2770fd6ea — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:30

                with open(os.path.join(dirname, name), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14c427e3f1a64853 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/src/myinstall.py:6

prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e1455ea4510b7ff — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/src/myinstall.py:13

with open(os.path.join(dirname, sys.argv[2] + '.in'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03b3124c16607422 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/54 custom target source output/generator.py:10

with open(os.path.join(odir, 'mylib.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59cd5ba8a67976e5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/54 custom target source output/generator.py:12

with open(os.path.join(odir, 'mylib.c'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dde45e9a9c1fd3b5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/57 custom header generator/makeheader.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #094f2c03a0634936 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/57 custom header generator/makeheader.py:11

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b524897cf7ec448 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #507002a1c751ddde — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:16

with open(outhdr, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a145c2dd3fa922b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:18

with open(outsrc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6043ece7c6beecbd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:13

    with open(infile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbc2ba8db3800731 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:16

        with open(outfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13a9f8fb2a07f61d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:22

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3ee2a4074b8e649 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/69 configure file in custom target/src/mycompiler.py:5

with open(sys.argv[1]) as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad737a842644132e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/69 configure file in custom target/src/mycompiler.py:8

with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #146f9bfab0f4c2c0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9c7afa84c4aca03 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:11

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61da1ce8ad6cdaf7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9

with open(files[0]) as ifile, open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe3819c1e3444f9c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/8 install/gendir.py:8

open(fname, 'w').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae5f8f631befdf74 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/86 private include/stlib/compiler.py:29

with open(cfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e132042c7d640a72 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/86 private include/stlib/compiler.py:31

with open(hfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6de6519ffbf7c28e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/88 dep fallback/subprojects/boblib/genbob.py:5

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73aedaea3556dfa5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen.py:21

with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d2cc65ebb64bb8c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen.py:26

with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a594ceaee0b24562 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:17

with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97dccf9a6db48d63 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:22

with open(output_c, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08aacc451d0343bd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:31

with open(output_h, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e01d1046fa611b23 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen3.py:12

with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91125441cf2f5ba6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/92 test workdir/subdir/checker.py:5

data = open(sys.argv[1], 'rb').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed73af445f62f99d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fd56d0c262f5fed — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43

with open(outc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e42462ea0d0e5d1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50

with open(outh, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81ff0ba6fa8c21ec — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57

with open(tmpc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c032c8732ad0962 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:68

with open(tmpc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23b0b19923c0223e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:10

input_file = os.path.join(os.environ['MESON_SOURCE_ROOT'], 'raw.dat')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d8efec72916349b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:11

output_file = os.path.join(os.environ['MESON_BUILD_ROOT'], 'generated.h')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e33afca0e9e79e7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:13

with open(input_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af8a2cfd7ece9e17 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:15

with open(output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1f303bc9c30b410 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/gen.py:10

with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2e270aee2881010 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/generator.py:11

with open(args.input) as i, open(args.output, 'w') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #421948fbdc6f1d2d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/libdir/gen.py:10

with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca56fa1d04c7bc0e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/39 custom target plainname many inputs/catfiles.py:6

with open(out, 'wb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a7bf8fbdffba022 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/39 custom target plainname many inputs/catfiles.py:8

        with open(infile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c384d957412379cd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:11

with open(os.path.join(odir, name + '.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b084d63cafd7db32 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:13

with open(os.path.join(odir, name + '.c'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #991f9f2213d1561b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:15

with open(os.path.join(odir, name + '.sh'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #822d6210e47630c9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/88 custom target install data/preproc.py:11

with open(outf, 'wb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #503b653fb043c71d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/88 custom target install data/preproc.py:12

    with open(inf, 'rb') as i:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c91f1d05b6a28e8c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/format/5 transform/file_compare.py:16

    with open(args.actual, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6be70e0b93b77e23 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/format/5 transform/file_compare.py:18

    with open(args.expected, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa544932ab2e6d54 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/fortran/7 generated/gen.py:36

    with open(args.input, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #676dbbd487e05cc0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/fortran/7 generated/gen.py:41

    with open(args.output, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28f9138e6b5e2f11 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/10 gtk-doc/include/generate-enums-docbook.py:52

        with open(sys.argv[1], 'w') as doc_out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4eb78ba0c22a8ecd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/4 qt/subfolder/generator.py:5

    with open(sys.argv[1], "w") as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf3c54b01588e23f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/6 gettext/data3/verify.py:12

with open(fname, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #126ae09873e7b38e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/osx/2 library versions/require_pkgconfig.py:6

if 'CI' in os.environ or shutil.which('pkg-config'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #058f89f9e1d20f92 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/python/4 custom target depends extmodule/blaster.py:25

    with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd4063a538749111 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/python3/4 custom target depends extmodule/blaster.py:26

    with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04d235d24f21a006 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/rust/11 generated main/gen.py:12

    with open(args.out, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d44c865c34f98d4b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/rust/19 structured sources/gen.py:12

    with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54cdd371d5396e29 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/2 testsetups/envcheck.py:5

assert 'PATH' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45db4042e0f25617 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/26 install umask/myinstall.py:6

prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bea6290ecc5874c6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/26 install umask/myinstall.py:16

with open(os.path.join(dirname, sys.argv[2]), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42e3a748ff1089ac — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:10

source_root = pathlib.Path(os.environ['MESON_DIST_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31fce8a3f596db84 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:14

contents = modfile.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf6643c817c1d04d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:16

modfile.write_text(contents)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a118ea6316a5e0ab — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/subprojects/sub/dist-script.py:11

source_root = pathlib.Path(os.environ['MESON_PROJECT_DIST_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7793c3fe5e922d0f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/subprojects/sub/dist-script.py:12

mesonrewrite = shlex.split(os.environ['MESONREWRITE'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fc9ea90f08946db — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/45 native dep pkgconfig var/cross_pkgconfig.py:7

environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64e1eee08b8dee87 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:5

assert 'ENV_A' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #884bf4284ae827b7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:6

assert 'ENV_B' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e18241fb4a6b930 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:7

assert 'ENV_C' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c1f870d6ebe75cf — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:9

print('ENV_A is', os.environ['ENV_A'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ac20bd93e48c99a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:10

print('ENV_B is', os.environ['ENV_B'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ec25e98f976dd37 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:11

print('ENV_C is', os.environ['ENV_C'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3af5ab2f7d47470b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/67 test env value/test.py:6

assert os.environ['TEST_VAR'] == sys.argv[1]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe881709555fe4a9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/70 cross test passed/exewrapper.py:15

    defined = 'MESON_EXE_WRAPPER' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de80674c0c9a88a9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/70 cross test passed/exewrapper.py:18

        print(os.environ, file=sys.stderr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #045ac7544967eb51 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:5

assert os.environ['MESON_DEVENV'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9702c53d1e45929 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:6

assert os.environ['MESON_PROJECT_NAME'] == 'devenv'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4ca86842ec2fa8e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:7

assert os.environ['TEST_A'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f3471b523990aa6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:8

assert os.environ['TEST_B'] == '0+1+2+3+4'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8bb81c0c8817c7e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:9

assert os.environ['TEST_C'] == os.pathsep.join(['/prefix', '/suffix'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb5f6ef1627cfbda — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/94 custominc/easytogrepfor/genh.py:5

f = open(sys.argv[1], 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75f8cf01ced3d674 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/98 install all targets/script.py:6

  with open(f, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55134f0135ae898e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/98 install all targets/subdir/script.py:6

  with open(f, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96bfdbff4d6b853f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/vala/10 mixed sources/c/writec.py:11

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90ef359e4e8fcd45 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/vala/8 generated sources/src/write_wrapper.py:11

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0b8f6ab10ae1e7b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/10 vs module defs generated custom target/subdir/make_def.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1e96f855de30876 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/12 resources with custom targets/res/gen-res.py:5

with open(sys.argv[1]) as infile, open(sys.argv[2], 'w') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb1c043fe60bb530 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/14 resources with custom target depend_files/ico/gen-ico.py:5

with open(sys.argv[1], 'rb') as infile, open(sys.argv[2], 'wb') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d9aad2b9ab80c28 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/16 gui app/gui_app_tester.py:8

    if 'CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0b0760d1a71a17fc — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/ac_converter.py:362

with open(sys.argv[1], encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7705cfd9894e3adf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:69

    raw = jamroot.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cf877d92e6e079ca — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:82

    raw = jamfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6f32c5acfb9ae809 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:176

    data = json.loads(meta_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7299a527adfc46b9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/tools/build_website.py:30

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3a2702fd36633af0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/dircondenser.py:46

    with open(sourcefile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #abad7a380a893dea — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/dircondenser.py:50

    with open(sourcefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #efd21ad345c65a70 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:23

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #67ac46a7944e55f0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:121

            with open(output_dir / (cmd+'_'+typ+'.inc'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #5cd89cd5f1a8b6d5 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:125

    url = urlopen('https://wrapdb.mesonbuild.com/v2/releases.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #2b15e9766afd325e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:127

    with open(output_dir / 'wrapdb-table.md', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9214226f3ef2ba24 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:160

        with open(output_dir/dummy_output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8eafdf501c577df — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:12

        if v in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b21491c70d2ed2f1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:13

            del os.environ[v]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1f304b3b2eee487 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:16

    os.environ.setdefault('MESON_UNIT_TEST_BACKEND', 'ninja')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #400bb4b91086fc35 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:136

                with open(fin, 'wb') as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #992e044ab1cbe37c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:140

                    with open(fout, 'rb') as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #265eead20aefdff2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:258

                with open(os.path.join(self.builddir, header), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a7ab0b25e0a786e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:262

                with open(os.path.join(cmake_builddir, header), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e63d17432a799361 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:541

        text_log = Path(self.logdir, 'testlog.txt').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32cc707ca26ecf3e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:543

        json_log = json.loads(Path(self.logdir, 'testlog.json').read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c38f05e6f2fdc61 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:741

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e499d9ea2cb48ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:760

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f464a224a986629a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:800

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d5a312a7ee2b003 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:805

        with open(os.path.join(self.logdir, 'testlog-valgrind.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3650fb65bdf2b117 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:825

        with open(os.path.join(self.logdir, 'testlog-good.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a61b2e2bf1f7c687 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:830

        with open(os.path.join(self.logdir, 'testlog-good.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b97a67213d1e53b6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:866

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dd7af9235990796 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:871

        with open(os.path.join(self.logdir, 'testlog-mydefault.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89a5d91aab0d759b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:876

        with open(os.path.join(self.logdir, 'testlog-other.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7883ca17c5a5667b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:897

            with open(os.path.join(self.logdir, 'testlog.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #531fe4b20392e184 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1057

        if mesonbuild.envconfig.detect_msys2_arch() and ('MESON_RSP_THRESHOLD' in os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c96b87300eb29b42 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1122

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #531f1e321618bf58 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1143

            if evar in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15789990746975ae — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1156

                        evalue = os.environ.pop(evar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dd3b413f8ef2a63 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1237

                    if 'arch' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af4c31cc11b4aec5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1238

                        if os.environ['arch'] == 'x64':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a198a50c40314432 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1249

                os.environ[evar] = ' '.join(quote_arg(w) for w in wrappercc)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e949f627aeeb49e8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1253

                os.environ['AR'] = ' '.join(quote_arg(w) for w in wrapperlinker)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba0256ad49a68c25 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1268

                del os.environ['AR']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36ccc8e072c3cae5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1344

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b094e099d505be9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1573

            with open(os.path.join(project_dir, '.hg', 'hgrc'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15e54204b1c3f6da — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1613

        with open(os.path.join(path, 'meson.build'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b51cada8848f8af4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1621

            with open(os.path.join(project_dir, 'meson.build'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eeff39e0d862a539 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1631

            with open(distexe_c, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0dc3cefd71b7c696 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1969

                with open(os.path.join(d, 'alexandria.pc'), 'w',
                          encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #528fea8710e7a897 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2011

                with open(os.path.join(d, 'alexandriaConfig.cmake'), 'w',
                        encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c641c2372a5eea4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2140

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bf2467760d4ccf8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2148

        os.environ['PKG_CONFIG_LIBDIR'] = self.privatedir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e389fd3fd1546756 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2172

            with open(os.path.join(self.privatedir, name), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f6f80eb3a0809b9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2564

                    with open(os.path.join(tmpdir, 'foo.' + lang), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6ec56157b590e94 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2570

                    with open(os.path.join(tmpdir, 'Foo.' + lang), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58022bbcdb48a768 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2986

        with open(os.path.join(self.builddir, 'nosubst-nocopy1.txt'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f62d479b68a2bfcc — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2988

        with open(os.path.join(self.builddir, 'nosubst-nocopy2.txt'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bae56174c770a26f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2995

                of = open(mfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59a3514ad6ffc35f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3215

                            with open(intro_installed_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8acd89c3090d0980 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3223

        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bd17fe117473a1b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3226

        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ecb6741fd6ef9c3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3251

        open(filename, 'w', encoding='utf-8').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8f16f585d8cbab3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3406

            self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15bd85f203aadc76 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3407

                                Path(goodfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #803def44ec8f3e76 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3408

            self.assertNotEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bdf3ea2775ea38b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3409

                                Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7577f37629d67b7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3413

            self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #549ed9fe8b65d398 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3414

                                Path(goodfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c7e3737aa5cd134 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3415

            self.assertNotEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7543ffc57fd7724 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3416

                                Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b243ccc50b19bb87 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3419

            with open(includefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8cc8f0a3e209316a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3422

            self.assertEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c265a536e6b1d1ad — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3423

                             Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2745d65c2d9ed94 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3465

        self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84b24f5c08e47eee — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3466

                            Path(fixedfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6b01c81392f25f4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3471

        self.assertEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7ab80fe9d76cb92 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3472

                         Path(fixedfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #01d6b3fcd1ff0ab0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3523

        with open(os.path.join(infodir, 'intro-targets.json'), encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59866e2e9d6c9e61 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3657

            with open(curr, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4631912d14e4b3c2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3795

            with open(curr, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35ada76587e840a7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3805

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85dffa52d6ae4691 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3820

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d97b1c301605a0ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3838

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c71ff0fe84e3fd87 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3849

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1776dc83b921b15f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4279

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45a98ef1b3912d31 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4296

        with open(doc_path, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5851a1488a01717c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4499

            with open(os.path.join(srcdir, 'subprojects', 'wrap_git.wrap'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98403b8561784770 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4516

            with open(os.path.join(srcdir, 'subprojects', 'wrap_git.wrap'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef56f13b8d6b270d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4553

        with open(machinefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd5966949531aa48 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4582

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d5c802c8cb91712 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4591

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbdc5a0deb693eae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4600

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be5830c8b8660185 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4609

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fda3b0dcf89116f1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4614

        with open(real_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dd441262d98c619 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4741

        o = Path(fname).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c94ecba5ba779e0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4800

        with mock.patch.dict(os.environ, {'CFLAGS': '-DCFLAG', 'LDFLAGS': '-flto'}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55255bb6c7265fa4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4991

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0a4aee60d2f0ec9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5324

        with open(gen_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d3c20b674e256ee — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5332

        with open(gen_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d0f7dd4751a459e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5409

        olddata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59d0382f38286c43 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5414

            newdata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fec78aecd4ffdeaa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5423

            newdata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8d7ab49ca3e773c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5585

        with open(os.path.join(testdir, 'mod1.f90'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #809aee71804d8efd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5595

        with open(os.path.join(testdir, 'test.f90'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4549b26d642f47de — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:72

        cls.backend_name = os.environ.get('MESON_UNIT_TEST_BACKEND', 'ninja')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c618ae00249ee6f7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:107

        cls.env_patch = mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #508a72e98261d55c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:110

        os.environ['COLUMNS'] = '80'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4792f05ec19fefbc — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:111

        os.environ['PYTHONIOENCODING'] = 'utf8'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee93bc4f0ed04e08 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:120

        if (is_windows() or is_cygwin()) and not os.environ.get('MESON_FORCE_UNITTEST_IN_TMP', '0') == '1':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #139368bd4a02cbe2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:160

        return open(log, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38325f072ebf7a1c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:186

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9ec53dff1932386 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:290

            with mock.patch.dict(os.environ, override_envvars):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #505c94aaad48476b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:341

            with open(os.path.join(self.builddir, 'compile_commands.json'), encoding='utf-8') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8da5cde18c4578f7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:355

                with open(rsp, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e3f9351b70db095 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:188

            with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4876e5e12c5b4086 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:328

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3791317bca15f1d5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:346

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8a713a299073361 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:360

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e7ba33216c7c533 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:397

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #526b7b92f3befdc8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:414

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #777da6fe4a68e112 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:438

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4589820eb523e64f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:454

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a5434078ac3d0cd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:494

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1678ea8cb69118d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:512

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #abd1f5e0efa198ab — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:546

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #60f9eab13c370b1a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:566

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0c0ece7e76f6565 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/darwintests.py:59

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2f165574267c781 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/darwintests.py:70

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #966a59444a626934 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:71

        with open('docs/markdown/Builtin-options.md', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc83ea16f8c96b39 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:105

        with open('docs/markdown/Builtin-options.md', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #869102eaef6b6d1f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:176

        with open("docs/markdown/Reference-tables.md", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf09ddf625720a9e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:192

        with open("docs/sitemap.txt", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac01286ecd5e4632 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:206

        with open("docs/theme/extra/templates/navbar_links.html", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #146a88565d1fd9f9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:218

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3289f3a04abcd40 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:228

        del os.environ['MESON_RUNNING_IN_PROJECT_TESTS']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6e11dfb2648f412 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:231

        with open('data/syntax-highlighting/vim/syntax/meson.vim', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4526403f21799082 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:236

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ed2cb9b9c50fe9b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:246

        del os.environ['MESON_RUNNING_IN_PROJECT_TESTS']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c3bf2e721fa32c4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:93

        with open(self.mbuild, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f86d5cd4bd4b0471 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:102

            with open(self.moptions, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #413b35351624e366 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:119

        with open(self.mbuild, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #493bcdeb4baccc75 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/featurestests.py:85

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #536970cd3bc8855b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/featurestests.py:96

        os.environ.pop('MESON_RUNNING_IN_PROJECT_TESTS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #409b47fb3917498f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:34

IS_CI = os.environ.get('MESON_CI_JOBNAME', 'thirdparty') != 'thirdparty'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e0f148252bad0b7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:211

            if not IS_CI and key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b13d87d02502430c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:213

            with mock.patch.dict(os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec94028a1e86f9ee — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:214

                os.environ.pop(key, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ce831b36e9f63bf — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:301

    if os.environ.get('MESON_CI_JOBNAME') == name:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fca2e1657e00062 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:727

            script_path.write_text('import sys\nprint(sys.argv[1])\n', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #917b6ea4d20c3f23 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:1081

        with open('data/test.schema.json', 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3854b23bcf720f0c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:1092

                schema_validator(json.loads(p.read_text(encoding='utf-8')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f9342e41dc36b4e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:42

PKG_CONFIG = os.environ.get('PKG_CONFIG', 'pkg-config')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #186cb211bbccde5c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:58

    pkgconf = os.environ.get('PKG_CONFIG_PATH')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5756d79199b0eb0e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:156

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b82c3c0f79b56b9d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:168

        os.environ['PKG_CONFIG_LIBDIR'] = self.privatedir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e1c62cb5f2916e5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:224

        with open(os.path.join(privatedir2, 'dependency-test.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46dc28bfb8443cf6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:255

        with open(os.path.join(privatedir1, 'simple2.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c08ec4164a499ca0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:260

        with open(os.path.join(privatedir1, 'simple3.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #faea315cde4a6338 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:264

        with open(os.path.join(privatedir1, 'simple5.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fcff8184139ab1c5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:268

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a3c68b6aa2c050a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:274

        os.environ['PKG_CONFIG_LIBDIR'] = os.path.join(self.builddir, 'meson-uninstalled')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8569e9666cc5900c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:276

            os.environ['PATH'] += os.pathsep + self.builddir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #169bc8ee50f2d830 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:287

        with open(os.path.join(self.privatedir, 'somename.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5578a04324170d9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:824

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89d4197a54cedc94 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:849

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25504581a91abec0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1132

            myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a061d47b69fbf4a4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1143

            myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3bd1fbbb5c3bf86 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1272

        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fcc3161fc2f81a9e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1287

        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aafb10ad561efd97 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1300

        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98b4ad407388b7ab — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1312

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #290f5d4a7d395c3b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1331

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84e5ebd731543999 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1344

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3593db6ee53d7608 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1430

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d19c8205a168143 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1495

                os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #562642c223bfc507 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1545

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #066dcb9bce661bb9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1554

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #faa9bc2a7f8ce0a5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1653

            with mock.patch.dict(os.environ, {envvar: name}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e68aafa57cc5f10 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1704

        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #156cf27b78e93a41 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1728

        with open(wrap_filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15990daa787d4f3e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1756

            with open(os.path.join(d, 'meson.build'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d08fa24e690627f0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1767

        with open(os.path.join(self.privatedir, 'bar1.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e0774294c18ed8a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1770

        with open(os.path.join(self.privatedir, 'bar2.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7394ace774e2e1d2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1888

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4f861efe4cbc9a0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:80

                home = PurePath(os.environ['HOME'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26a39df707c823f4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:84

                if 'USER' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa909a00e7ed1f1a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:86

                home = PurePath('C:\\', 'Users', os.environ['USER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a66c3762fb1a7549 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:112

        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #777fff1f987ab022 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:134

        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fe4c1238f2c3b20 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:172

        with open(batfile, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a9559da070f2784 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:206

                with open(fifo, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d42db9d29b32a2cc — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:793

    @skipIf('MESON_EXE' in os.environ, 'MESON_EXE is defined, cannot use mocking.')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ee2bf1de41a682a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:808

                with mock.patch.dict(os.environ, {'XDG_DATA_HOME': d}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd0ce315acc906ba — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:813

                with mock.patch.dict(os.environ, {'XDG_DATA_DIRS': d}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2893274b1f7cb4de — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:814

                    os.environ.pop('XDG_DATA_HOME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f64ae1f0cada2037 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:829

                with mock.patch.dict(os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c96c0dd15267fba — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:830

                    os.environ.pop('XDG_DATA_HOME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1178f3ecf22ba4d1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:843

        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c607a1482ec37289 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:943

                    del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ab011d6732198aa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:104

                with open(os.path.join(self.builddir, 'meson-info', 'intro-targets.json'), 'r', encoding='utf-8') as tgt_intro:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #32f7a6f71b48531b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:141

            with urllib.request.urlopen('https://wrapdb.mesonbuild.com') as p:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #a83c89c8028272e3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:174

        with open(os.path.join(testdir, 'test.json'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #714d790b6db44d16 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:295

        with open(os.path.join(self.builddir, 'meson-logs', 'profile-startup-modules.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d33947e2ae84955e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:298

        with open(os.path.join(testdir, 'expected_mods.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe42fe752ea7903b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:387

        with open(editorconfig, 'w', encoding='utf-8') as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55d123d83e53b1c1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:453

        with open(os.path.join(testdir, 'meson_options.txt'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7357128c765b40ea — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:462

        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a05010186d975b2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:464

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1a98d210c17a7e0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:487

        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb5b0999e80e0ae7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:489

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4b9a4c724878cfd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:502

        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94564b72373bf81b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:504

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9a0434fdd6f7293 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:527

        with open(os.path.join(testdir, 'meson.options'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c246978c6614703b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:536

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #753d0117417221ff — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:545

        with open(os.path.join(testdir, 'subprojects/subproject/meson_options.txt'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56e745d4f5c82755 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:600

            Path(d, 'bar.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #282e34994567c359 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:605

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7beebe8f481a9289 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:612

            Path(d, 'bar.c').write_text('int bar() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d128983e16230e93 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:613

            Path(d, 'foo.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd84712410b11a6b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:617

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #505815a61a1ad3df — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:624

            Path(d, 'bar.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5120415dffc27685 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:629

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6db3cce7e9dc17d1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:640

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de7c22a471531f9f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/pythontests.py:45

            mesonfile.write_text('''project('test', 'c', version: '1')
pymod = import('python')
python = pymod.find_installation('python3', required: true)
''', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5118c9117008141 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/rewritetests.py:485

        original_contents = meson_build_file.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #072bc7e85335a4b8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/rewritetests.py:531

        expected = Path(test_path / "expected_dag.txt").read_text(encoding='utf-8').strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1d03b34bc3d5884 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:35

        with open(str(path / 'meson.build'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5ca5d73e73a663e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:97

        with open(str((self.subprojects_dir / name).with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1cafe3ac7b06b4c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:112

        with open(str((self.subprojects_dir / name).with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #732d4613a707ad61 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:260

        with open(str((self.subprojects_dir / 'redirect').with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22eeccbbcb0f104e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:49

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ecfd5f7fa6193170 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:78

        os.environ['PATH'] += os.pathsep + testdir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3709548793993274 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:80

        if '.PY' in [ext.upper() for ext in os.environ['PATHEXT'].split(';')]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec74793c28fbdf56 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:104

        path = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #638ac861152958df — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:106

            username = os.environ['USERNAME']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1c731e4ba22922c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:240

            current_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7930f61440e6506c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:296

            with mock.patch.dict(os.environ, {envvar: name}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #012e9d439f5154ce — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:382

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bd0a304cb0deb4d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:441

        if 'VSCMD_VER' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #471b42c436500ec5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:443

        if version_compare(os.environ['VSCMD_VER'], '<16.10.0'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dffc5cacfa5bf3b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:466

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ollama

python dependency

expand_more 12 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #aa64778119dae752 — Filesystem access.

pkgs/python/[email protected]/examples/generate-image.py:13

    with open('output.png', 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #e5577ed246426735 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/multimodal-generate.py:8

latest = httpx.get('https://xkcd.com/info.0.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #0166923aa01e68de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/multimodal-generate.py:13

comic = httpx.get(f'https://xkcd.com/{num}/info.0.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #8007b211ef48c161 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/multimodal-generate.py:20

raw = httpx.get(comic.json().get('img'))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #44738edf2a9da30f — Environment-variable access.

pkgs/python/[email protected]/ollama/_client.py:108

    api_key = os.getenv('OLLAMA_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa951d2dea0a4c07 — Environment-variable access.

pkgs/python/[email protected]/ollama/_client.py:113

      base_url=_parse_host(host or os.getenv('OLLAMA_HOST')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #06b5c8a7feace432 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/ollama/_client.py:139

      r = self._client.request(*args, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #3116c5b4fc9a784c — Filesystem access.

pkgs/python/[email protected]/ollama/_client.py:611

    with open(path, 'rb') as r:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da8d0dd61e1bd765 — Filesystem access.

pkgs/python/[email protected]/ollama/_client.py:620

    with open(path, 'rb') as r:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #3d2a27cf705f01d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/ollama/_client.py:732

      r = await self._client.request(*args, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8bde639da5e40c40 — Filesystem access.

pkgs/python/[email protected]/ollama/_types.py:167

      return b64encode(self.value.read_bytes() if isinstance(self.value, Path) else self.value).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93ed483c1ae3d2f3 — Filesystem access.

pkgs/python/[email protected]/ollama/_types.py:172

          return b64encode(Path(self.value).read_bytes()).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

python dependency

expand_more 69 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #b0b0d7acac41f314 — Filesystem access.

pkgs/python/[email protected]/examples/image_stream.py:30

            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f8eb79f62953033e — Filesystem access.

pkgs/python/[email protected]/examples/image_stream.py:41

            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8209782e77c1d166 — Environment-variable access.

pkgs/python/[email protected]/examples/realtime/azure_realtime.py:31

    endpoint = os.environ["AZURE_OPENAI_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0300976cc53b5f67 — Environment-variable access.

pkgs/python/[email protected]/examples/realtime/azure_realtime.py:37

    deployment_name = os.environ["AZURE_OPENAI_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #23927c1e27bab4ad — Filesystem access.

pkgs/python/[email protected]/examples/uploads.py:30

    data = file.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #948d3d001eadf34e — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:158

api_type: _ApiType | None = _t.cast(_ApiType, _os.environ.get("OPENAI_API_TYPE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94575bc6988c1253 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:160

api_version: str | None = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ff9bb1b0e62ae29 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:162

azure_endpoint: str | None = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71f8119efc2d3220 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:164

azure_ad_token: str | None = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1920428c03ba5e1 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:338

    return _os.environ.get("OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #792546225b9e6781 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:342

    return azure_endpoint is not None or _os.environ.get("AZURE_OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71e439e4b3779df2 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:347

        _os.environ.get("AZURE_OPENAI_AD_TOKEN") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfb6c3f8bf93fd5f — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:363

            azure_endpoint = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81fb5f9264901d40 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:366

            azure_ad_token = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b39698ec6f03d289 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:369

            api_version = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22db89a286320447 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:379

            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b424d815bc2739d — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:379

            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(
                "AZURE_OPENAI_API_KEY"
            ) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #5cdbddfa6813ca03 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/_base_client.py:309

        return await self._client.request(self._page_cls, self._options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #1678e725b83e1996 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:209

                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d825baf5dfefe705 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:219

            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d88d641a9243050 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:235

            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3887fe8d77533312 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:239

            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9a55bf804f3bf9a — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:243

            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b64a885fc2dfd43b — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:251

            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58aa47096f8c17e7 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:255

        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc77ed498bf3edf9 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:805

                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3bf6e0097db9225 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:815

            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8deb06c47d8eef9 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:831

            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90699de7e679f23a — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:835

            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eec51d857030dc0c — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:839

            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8648cf2b7104f85 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:847

            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #534ed5e51e5d791f — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:851

        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #825287ca1abe3014 — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:69

            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a09eaf54b631f250 — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:81

        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #477bbc7562603be8 — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:111

            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b3d7c992eab7a80 — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:123

        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5fba935211f64bd — Filesystem access.

pkgs/python/[email protected]/src/openai/_legacy_response.py:441

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc7ac01b609719c9 — Filesystem access.

pkgs/python/[email protected]/src/openai/_legacy_response.py:454

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54a0201b7e3fa614 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_models.py:129

            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0406746ccfa8c864 — Filesystem access.

pkgs/python/[email protected]/src/openai/_response.py:513

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a33eab8cfdec741 — Filesystem access.

pkgs/python/[email protected]/src/openai/_response.py:555

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a24f77df92e09178 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_utils/_logs.py:23

    env = os.environ.get("OPENAI_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e5087ed5f46458f — Filesystem access.

pkgs/python/[email protected]/src/openai/_utils/_transform.py:248

            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #516c47db50c88dae — Filesystem access.

pkgs/python/[email protected]/src/openai/_utils/_transform.py:414

            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #084a0285ef68b8cc — Filesystem access.

pkgs/python/[email protected]/src/openai/_utils/_utils.py:383

    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad536246fa4579f8 — Filesystem access.

pkgs/python/[email protected]/src/openai/auth/_workload.py:58

            with open(token_file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #74ab2097057227f8 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:106

                response = http_client.get(url, params=params, headers={"Metadata": "true"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #11c8e247e0ea4761 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:109

                    response = client.get(url, params=params, headers={"Metadata": "true"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7d93ac72a19cdfb9 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:153

                response = http_client.get(url, params=params, headers={"Metadata-Flavor": "Google"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e7a42efb2bf1d9be — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:156

                    response = client.get(url, params=params, headers={"Metadata-Flavor": "Google"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bce130a8a88ebd31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:249

            response = client.post(
                self.token_exchange_url,
                json={
                    "grant_type": TOKEN_EXCHANGE_GRANT_TYPE,
                    "subject_token": subject_token,
                    "subject_token_type": subject_token_type,
                    "identity_provider_id": self.workload_identity["identity_provider_id"],
                    "service_account_id": self.workload_identity["service_account_id"],
                },
                timeout=10.0,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #33e9172a503ff041 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/_bedrock_auth.py:172

        region = os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #839a1852dc82f2e4 — Filesystem access.

pkgs/python/[email protected]/src/openai/lib/_validators.py:485

                with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba2b61bf57d69afe — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:214

            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #01717ff25b7a29a2 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:217

            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ca29ff0ee6327bc — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:225

            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e0ddf1e2e46551c — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:239

                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #892996e1ef089fad — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:538

            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7af61508ec8d9eeb — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:541

            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69920e9279b01b16 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:549

            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e692d6ef9037389a — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:563

                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cea020efc2c600f0 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:70

    configured = region or os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb9c3a21d31fc07b — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:80

    environment_base_url = os.environ.get("AWS_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0295259331f87ea7 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:105

    token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8aaf254e5635b513 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:150

    environment_token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b69939d82828a4b4 — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:248

            token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48d1d1e8a8633944 — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:331

            os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67d5ac1bb81bf471 — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:338

        environment_base_url = _normalize_optional_string(os.environ.get("AWS_BEDROCK_BASE_URL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6e73d7a480a0a14 — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:391

        and bool(os.environ.get("AWS_BEARER_TOKEN_BEDROCK"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

oracledb

python dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #29219903bc66d0be — Environment-variable access.

pkgs/python/[email protected]/setup.py:95

extra_compile_args = os.environ.get("PYO_COMPILE_ARGS", "").split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aeb78345f48d1aa0 — Filesystem access.

pkgs/python/[email protected]/src/oracledb/builtin_hooks.py:62

    config = json.load(open(file_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd75227701a39a0f — Filesystem access.

pkgs/python/[email protected]/src/oracledb/plugins/oci_config_provider.py:135

            with open(parameters["oci_key_file"], "r") as file_content:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86ee1f32eb1ecebc — Filesystem access.

pkgs/python/[email protected]/src/oracledb/plugins/oci_tokens.py:162

    token = pathlib.Path(config["security_token_file"]).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #9e758c9101e5669c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/oracledb/plugins/oci_tokens.py:232

    response = requests.post(
        end_user_sec_params.get("authority"), headers=headers, data=payload
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pandas

python dependency

expand_more 29 low-confidence finding(s)

low env_fs dependency Excluded from app score #c9e25a62e8922713 — Filesystem access.

pkgs/python/[email protected]/generate_pxi.py:8

    with open(pxifile, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1b53821786f0cd2 — Filesystem access.

pkgs/python/[email protected]/generate_pxi.py:12

    with open(outfile, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8d3f21ebc9da951 — Environment-variable access.

pkgs/python/[email protected]/generate_version.py:25

    if os.environ.get("MESON_DIST_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e2ed5a5bd61a2c7 — Environment-variable access.

pkgs/python/[email protected]/generate_version.py:26

        path = os.path.join(os.environ.get("MESON_DIST_ROOT"), path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a9195b544860fc5 — Filesystem access.

pkgs/python/[email protected]/generate_version.py:27

    with open(path, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31a2b9cd01ed00d5 — Environment-variable access.

pkgs/python/[email protected]/pandas/_testing/contexts.py:76

                    del os.environ["TZ"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f904cb905ebd3460 — Environment-variable access.

pkgs/python/[email protected]/pandas/_testing/contexts.py:80

                os.environ["TZ"] = tz

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff54376e82ed1b60 — Environment-variable access.

pkgs/python/[email protected]/pandas/_testing/contexts.py:85

    orig_tz = os.environ.get("TZ")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d39a3813bf38036 — Filesystem access.

pkgs/python/[email protected]/pandas/_version.py:159

        with open(versionfile_abs, encoding="utf-8") as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #875ef173f576b504 — Environment-variable access.

pkgs/python/[email protected]/pandas/_version.py:264

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd40b703f197eb35 — Environment-variable access.

pkgs/python/[email protected]/pandas/compat/__init__.py:154

    return os.environ.get("PANDAS_CI", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8d1f807aaca9189 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:425

        if os.environ.get("PANDAS_COPY_ON_WRITE", "0") == "warn"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08b4f64dbc0f9bf9 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:426

        else os.environ.get("PANDAS_COPY_ON_WRITE", "1") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8daa8d5e7db8433 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:878

        False if os.environ.get("PANDAS_FUTURE_INFER_STRING", "1") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3aef1a5c20e03285 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:895

        os.environ.get("PANDAS_FUTURE_DISTINGUISH_NAN_AND_NA", "0") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2db58a90d4b758d5 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:906

        False if os.environ.get("PANDAS_FUTURE_PYTHON_SCALARS", "0") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd5357ca8df1c1a8 — Filesystem access.

pkgs/python/[email protected]/pandas/core/series.py:1573

            with open(buf, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d97ed5d37d97d741 — Environment-variable access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:74

HAS_DISPLAY = os.getenv("DISPLAY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc5a3c81974d0cdc — Filesystem access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:302

        with open("/dev/clipboard", "w", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a3f56e6db8d75e7 — Filesystem access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:306

        with open("/dev/clipboard", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e973e8f2554cf530 — Environment-variable access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:569

        if os.environ.get("WAYLAND_DISPLAY") and _executable_exists("wl-copy"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #91cf985c0f417c3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pandas/io/common.py:282

    return urllib.request.urlopen(*args, **kwargs)  # noqa: TID251

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #69ace3af77244c0a — Filesystem access.

pkgs/python/[email protected]/pandas/io/common.py:930

            handle = open(
                handle,
                ioargs.mode,
                encoding=ioargs.encoding,
                errors=errors,
                newline="",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a86fdf350a132f88 — Filesystem access.

pkgs/python/[email protected]/pandas/io/common.py:939

            handle = open(handle, ioargs.mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c952fa6cc426f0c — Filesystem access.

pkgs/python/[email protected]/pandas/io/common.py:1192

        handle = open(handle, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff0c270882fcc8fd — Filesystem access.

pkgs/python/[email protected]/pandas/io/formats/format.py:1076

        with open(buf, "w", encoding=encoding, newline="") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90764e17622b74b0 — Environment-variable access.

pkgs/python/[email protected]/pandas/util/_print_versions.py:57

        "LC_ALL": os.environ.get("LC_ALL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2984883daea24989 — Environment-variable access.

pkgs/python/[email protected]/pandas/util/_print_versions.py:58

        "LANG": os.environ.get("LANG"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fff46438a32ac68 — Filesystem access.

pkgs/python/[email protected]/pandas/util/_print_versions.py:148

            with open(as_json, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pinecone

python dependency

expand_more 94 low-confidence finding(s)

low env_fs dependency Excluded from app score #56aaa56a39730a7a — Environment-variable access.

pkgs/python/[email protected]/pinecone/__init__.py:212

if _os.environ.get("PINECONE_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #45c87503765f87b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/_client.py:529

        response = self._http.post(f"/backups/{backup_id}/create-index", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8182c19b3fe1dd3f — Environment-variable access.

pkgs/python/[email protected]/pinecone/_internal/config.py:60

    raw = os.environ.get("PINECONE_ADDITIONAL_HEADERS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6f38b6f21ba0c0c — Environment-variable access.

pkgs/python/[email protected]/pinecone/_internal/config.py:159

            env_key = os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83e26981f5b08ed1 — Environment-variable access.

pkgs/python/[email protected]/pinecone/_internal/config.py:162

            env_host = os.environ.get("PINECONE_CONTROLLER_HOST", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56e057bfdde98a5a — Environment-variable access.

pkgs/python/[email protected]/pinecone/_internal/http_client.py:109

    if not os.environ.get("PINECONE_DEBUG_CURL"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #9cee8d2ea6030f18 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/_internal/http_client.py:515

            response = self._client.get(path, timeout=effective_timeout, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ea047560fa0d1832 — Environment-variable access.

pkgs/python/[email protected]/pinecone/_internal/http_client.py:535

            if os.environ.get("PINECONE_DEBUG_CURL"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #97e134082f9962b2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/_internal/http_client.py:619

            response = self._client.put(path, timeout=effective_timeout, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a92bb2947cb4b2d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/_internal/http_client.py:772

            response = await self._ensure_client().post(
                path, timeout=effective_timeout, **_prepare_json_kwargs(kwargs)
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ce3b3d465269ebcc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/_internal/http_client.py:788

            response = await self._ensure_client().put(
                path, timeout=effective_timeout, **_prepare_json_kwargs(kwargs)
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #c27f6007f8972b4f — Environment-variable access.

pkgs/python/[email protected]/pinecone/admin/admin.py:103

        resolved_id = client_id or os.environ.get("PINECONE_CLIENT_ID", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3cf2be4491cd67e — Environment-variable access.

pkgs/python/[email protected]/pinecone/admin/admin.py:104

        resolved_secret = client_secret or os.environ.get("PINECONE_CLIENT_SECRET", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #4a99e5172dd1085a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/admin/admin.py:194

                response = client.post(
                    _OAUTH_URL,
                    content=body,
                    headers={
                        "Content-Type": "application/json",
                        "User-Agent": build_user_agent(__version__, source_tag),
                        API_VERSION_HEADER: ADMIN_API_VERSION,
                    },
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8be2f465c496552d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/admin/api_keys.py:79

        response = self._http.get(f"/admin/projects/{project_id}/api-keys")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b5cd660284ab4382 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/admin/api_keys.py:134

        response = self._http.post(f"/admin/projects/{project_id}/api-keys", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d1034879ac8a0d22 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/admin/api_keys.py:161

        response = self._http.get(f"/admin/api-keys/{api_key_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1a20b222106829de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/admin/organizations.py:82

        response = self._http.get(f"/admin/organizations/{organization_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1fed3c87bb641f3e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/admin/projects.py:141

        response = self._http.get(f"/admin/projects/{project_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #65de450d581b21f6 — Environment-variable access.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:85

        env_control_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_CONTROL_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04166f660d2171f4 — Environment-variable access.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:105

        env_data_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_DATA_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #5d478a2dbbf92efc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:325

        response = await self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7d0a3656e3291cbf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:639

        response = await data_http.get(f"/files/{assistant_name}/{file_id}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #00ec268d4cf9b1e2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:714

        response = await list_http.get(f"/files/{assistant_name}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #21e9824b1d08b12e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:781

            response = await data_http.get(f"/files/{assistant_name}/{file_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fb29311f566db721 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:854

            response = await upsert_http.get(f"/operations/{assistant_name}/{operation_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #64b30f7cd466b641 — Filesystem access.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:948

            handle = io.BytesIO(await anyio.Path(file_path).read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #e0aa8bfb80e22662 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:980

            upsert_response = await upsert_http.put(
                f"/files/{assistant_name}/{file_id}",
                files=upsert_files,
                params=upsert_query,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5e990e2d630ba8a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:995

        response = await data_http.post(
            f"/files/{assistant_name}",
            files={"file": (upload_name, handle)},
            params=params,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #047665a97a6431f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:1173

        response = await http.post(f"/chat/{assistant_name}/context", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #91fc1b669d5de4e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:1295

        response = await data_http.post(f"/chat/{assistant_name}", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9f609d0f055c8d3c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:1448

        response = await data_http.post(f"/chat/{assistant_name}/chat/completions", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7540e5c116e2b8af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/assistants.py:1543

            response = await self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #c783eba6a458f5ba — Environment-variable access.

pkgs/python/[email protected]/pinecone/async_client/async_index.py:103

        resolved_key = api_key or os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #f1d07f02155c4270 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/async_index.py:224

        response = await self._http.post(
            f"/records/namespaces/{namespace}/upsert",
            timeout=timeout,
            content=ndjson_body.encode("utf-8"),
            headers={"Content-Type": "application/x-ndjson"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ef8372bc0d035942 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/async_index.py:1063

        response = await self._http.post(
            f"/records/namespaces/{namespace}/search", timeout=timeout, json=body
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b76dc5642b096af6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/async_index.py:1327

        response = await self._http.get(f"/namespaces/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6d31d1f6248506cc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/async_index.py:1588

        response = await self._http.get(f"/bulk/imports/{str_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #68955f25c00d2176 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/backups.py:97

        response = await self._http.post(f"/indexes/{index_name}/backups", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1c40c9cf1fd4d5d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/backups.py:157

        response = await self._http.get(path, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5e3b976563a7c452 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/backups.py:188

        response = await self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b2fc496f40e29429 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/collections.py:127

        response = await self._http.get(f"/collections/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #01a863308be61d1f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/indexes.py:128

        response = await self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f04107718d414919 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/inference.py:400

        response = await self._http.get(f"/models/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4279339e2b53f439 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/pinecone.py:431

        response = await self._http.post(f"/backups/{backup_id}/create-index", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f141c602cf4ca88f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/async_client/restore_jobs.py:122

        response = await self._http.get(f"/restore-jobs/{job_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2b5fa05f99bdc75b — Environment-variable access.

pkgs/python/[email protected]/pinecone/client/assistants.py:82

        env_control_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_CONTROL_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b53ff2d7a00a9875 — Environment-variable access.

pkgs/python/[email protected]/pinecone/client/assistants.py:102

        env_data_host = os.getenv("PINECONE_PLUGIN_ASSISTANT_DATA_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #10d96d908e1d14fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:237

            response = upsert_http.get(f"/operations/{assistant_name}/{operation_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #222c51e2e0a8cc30 — Filesystem access.

pkgs/python/[email protected]/pinecone/client/assistants.py:320

            opened_file = open(file_path, "rb")  # noqa: SIM115

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8ccca3a90b135649 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:354

                upsert_response = upsert_http.put(
                    f"/files/{assistant_name}/{file_id}",
                    files=upsert_files,
                    params=upsert_query,
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #27d43d82b2d23e53 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:367

            response = data_http.post(
                f"/files/{assistant_name}",
                files={"file": (upload_name, handle)},
                params=params,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e0a9f03630a53a43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:398

            response = data_http.get(f"/files/{assistant_name}/{file_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b8d1a51a4dee6b29 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:450

        response = data_http.get(f"/files/{assistant_name}/{file_id}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fd10881b770b1d86 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:566

        response = list_http.get(f"/files/{assistant_name}", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1535bf9a8dbad527 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:783

        response = self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #450ceaddf4f38921 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:1139

        response = http.post(f"/chat/{assistant_name}/context", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dc042924eccfb8ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:1251

        response = http.post(f"/chat/{assistant_name}", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #783170aeed80224b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:1343

        response = http.post(f"/chat/{assistant_name}/chat/completions", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #49618292d38a8a56 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/assistants.py:1482

            response = self._http.get(f"/assistants/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #907555b175a9ea7e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/backups.py:87

        response = self._http.post(f"/indexes/{index_name}/backups", json=body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #76db45adb3a08ad6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/backups.py:137

        response = self._http.get(path, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3eac111d42854540 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/backups.py:165

        response = self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #97ed6dfe5eec9b7b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/collections.py:125

        response = self._http.get(f"/collections/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a5139ad306bba576 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/indexes.py:124

        response = self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #662443166902f40a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/inference.py:409

        response = self._http.get(f"/models/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #63e6d55ce85de6dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/client/restore_jobs.py:111

        response = self._http.get(f"/restore-jobs/{job_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #da977fa7fc5d79f7 — Environment-variable access.

pkgs/python/[email protected]/pinecone/config/pinecone_config.py:32

    raw = os.environ.get("PINECONE_ADDITIONAL_HEADERS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #996f6e995fbe28dc — Environment-variable access.

pkgs/python/[email protected]/pinecone/config/pinecone_config.py:75

            host = os.environ.get("PINECONE_CONTROLLER_HOST", _DEFAULT_HOST)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0a71b2fce37d22f — Environment-variable access.

pkgs/python/[email protected]/pinecone/grpc/__init__.py:201

        resolved_key = api_key or os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #681902c06aa74054 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/grpc/__init__.py:1388

        response = self._http.post(
            f"/records/namespaces/{namespace}/upsert",
            timeout=timeout,
            content=ndjson_body.encode("utf-8"),
            headers={"Content-Type": "application/x-ndjson"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #05bd50b10993b5d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/grpc/__init__.py:1512

        response = self._http.post(
            f"/records/namespaces/{namespace}/search", timeout=timeout, json=body
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cf5537289d3c80e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/grpc/__init__.py:1872

        response = self._http.get(f"/bulk/imports/{str_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #3433964c023a8715 — Environment-variable access.

pkgs/python/[email protected]/pinecone/index/__init__.py:112

        resolved_key = api_key or os.environ.get("PINECONE_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #13d000708e919d7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/index/__init__.py:550

        response = self._http.post(
            f"/records/namespaces/{namespace}/upsert",
            timeout=timeout,
            content=ndjson_body.encode("utf-8"),
            headers={"Content-Type": "application/x-ndjson"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8f2bd8086430310f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/index/__init__.py:1210

        response = self._http.post(
            f"/records/namespaces/{namespace}/search", timeout=timeout, json=body
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #adec5e71710aaad9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/index/__init__.py:1341

        response = self._http.get(f"/namespaces/{effective}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #587ecfd1d1328705 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/index/__init__.py:1689

        response = self._http.get(f"/bulk/imports/{str_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9811072b04bf9034 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_documents.py:220

        response = await http.post(
            f"/namespaces/{namespace}/documents/upsert",
            json={"documents": documents},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #912621b2cee672d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_documents.py:401

        response = await http.post(
            f"/namespaces/{namespace}/documents/search",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aaec7afeb475eb14 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_documents.py:465

        response = await http.post(
            f"/namespaces/{namespace}/documents/fetch",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #01070cedbde6c9dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_documents.py:536

        await http.post(
            f"/namespaces/{namespace}/documents/delete",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #81c5a8be68e4c5a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_indexes.py:395

        response = await self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #abe32fb7259b5a80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_indexes.py:622

        response = await self._http.post(
            f"/indexes/{index_name}/backups",
            content=content,
            headers={"Content-Type": "application/json"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8ef7326b31a23243 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_indexes.py:688

            response = await self._http.get(f"/indexes/{index_name}/backups", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #929977382f59c9be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/async_indexes.py:730

        response = await self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aa40c0413f3a6a1d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/documents.py:202

        response = self._http.post(
            f"/namespaces/{namespace}/documents/upsert",
            json={"documents": documents},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8c745e4b9b138a65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/documents.py:376

        response = self._http.post(
            f"/namespaces/{namespace}/documents/search",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7e14302fd04b2350 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/documents.py:436

        response = self._http.post(
            f"/namespaces/{namespace}/documents/fetch",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3377ceb57faf7f40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/documents.py:501

        self._http.post(
            f"/namespaces/{namespace}/documents/delete",
            json=body,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3753f513f346c897 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/indexes.py:378

        response = self._http.get(f"/indexes/{name}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1c13c881c6e8d724 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/indexes.py:609

        response = self._http.post(
            f"/indexes/{index_name}/backups",
            content=content,
            headers={"Content-Type": "application/json"},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #dc28d4bc1fe58b28 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/indexes.py:674

            response = self._http.get(f"/indexes/{index_name}/backups", params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fc2c8b45dec7eba3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pinecone/preview/indexes.py:716

        response = self._http.get(f"/backups/{backup_id}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

prance

python dependency

expand_more 6 low-confidence finding(s)

low egress dependency Excluded from app score #819716da56f5ad2b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/prance/convert.py:46

    r = requests.post(
        "https://converter.swagger.io/api/convert", data=data, headers=headers
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #cd60a64598c9aa6c — Environment-variable access.

pkgs/python/[email protected]/prance/util/fs.py:69

            os.environ.get("SYSTEMDRIVE", "C:")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9273949cea04af99 — Filesystem access.

pkgs/python/[email protected]/prance/util/fs.py:244

    with open(filename, "rb") as raw_handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7b02b2008af4a84 — Filesystem access.

pkgs/python/[email protected]/prance/util/fs.py:306

    with open(filename, encoding=encoding) as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c999fcb7298cae1 — Filesystem access.

pkgs/python/[email protected]/prance/util/fs.py:326

    with open(fname, mode="w", encoding=encoding) as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #baee2b51eb2428f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/prance/util/url.py:205

        response = requests.get(url.geturl())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

psycopg

python dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #cbfe927f1c3af596 — Environment-variable access.

pkgs/python/[email protected]/psycopg/_conninfo_utils.py:81

    if (env := os.environ.get(paramdef.envvar)) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #956679769ea889f7 — Environment-variable access.

pkgs/python/[email protected]/psycopg/_dns.py:138

        if params.get("hostaddr", os.environ.get("PGHOSTADDR", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3c167c448c89be9 — Environment-variable access.

pkgs/python/[email protected]/psycopg/_dns.py:141

        host_arg: str = params.get("host", os.environ.get("PGHOST", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81c076ad74cc19bc — Environment-variable access.

pkgs/python/[email protected]/psycopg/_dns.py:143

        port_arg: str = str(params.get("port", os.environ.get("PGPORT", "")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1aee9f235faf6bd5 — Environment-variable access.

pkgs/python/[email protected]/psycopg/pq/__init__.py:61

    impl = os.environ.get("PSYCOPG_IMPL", "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36de234ba76f6b49 — Filesystem access.

pkgs/python/[email protected]/psycopg/pq/_pq_ctypes.py:807

    with open(fn) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #868e4701a19984ca — Filesystem access.

pkgs/python/[email protected]/psycopg/pq/_pq_ctypes.py:838

    with open(fn, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41c5c9acf0c1b81c — Environment-variable access.

pkgs/python/[email protected]/psycopg/waiting.py:437

if "PSYCOPG_WAIT_FUNC" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f97018ff4ca36380 — Environment-variable access.

pkgs/python/[email protected]/psycopg/waiting.py:438

    fname = os.environ["PSYCOPG_WAIT_FUNC"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pyarrow

python dependency

expand_more 23 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #ecdfca17d48b73cf — Filesystem access.

pkgs/python/[email protected]/examples/flight/client.py:168

            with open(args.tls_roots, "rb") as root_certs:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #13ad9ae32bf042ce — Filesystem access.

pkgs/python/[email protected]/examples/flight/client.py:171

        with open(args.mtls[0], "rb") as cert_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b2c33eafa8b2597d — Filesystem access.

pkgs/python/[email protected]/examples/flight/client.py:173

        with open(args.mtls[1], "rb") as key_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #811238bca87bd9e6 — Filesystem access.

pkgs/python/[email protected]/examples/flight/server.py:137

        with open(args.tls[0], "rb") as cert_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4fa392b62c0d208e — Filesystem access.

pkgs/python/[email protected]/examples/flight/server.py:139

        with open(args.tls[1], "rb") as key_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #ec4bfe541f0965a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:62

        r = requests.post(endpoint + master_key_identifier,
                          headers=headers,
                          data={'plaintext': base64.b64encode(key_bytes)})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low pii_flow tooling Excluded from app score unreachable #c654b28fceed67b1 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:62 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:60 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:62

        r = requests.post(endpoint + master_key_identifier,
                          headers=headers,
                          data={'plaintext': base64.b64encode(key_bytes)})

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

low egress tooling Excluded from app score unreachable #1074050fd1d95fed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:76

        r = requests.post(endpoint + master_key_identifier,
                          headers=headers,
                          data={'ciphertext': wrapped_key})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low pii_flow tooling Excluded from app score unreachable #dfda60f1b62bb6fa — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:76 · flow /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:74 → /tmp/closeopen-isn73khu/pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:76

        r = requests.post(endpoint + master_key_identifier,
                          headers=headers,
                          data={'ciphertext': wrapped_key})

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.

low env_fs tooling Excluded from app score unreachable #a7b01043cd9033e4 — Environment-variable access.

pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:117

        kms_instance_url=os.environ.get('VAULT_URL', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9ed893703437eee4 — Environment-variable access.

pkgs/python/[email protected]/examples/parquet_encryption/sample_vault_kms_client.py:118

        key_access_token=os.environ.get('VAULT_TOKEN', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7eaaef8d1f41ead5 — Environment-variable access.

pkgs/python/[email protected]/pyarrow/__init__.py:316

    return _os.environ.get('PKG_CONFIG', 'pkg-config')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b16f1bcdb2e8b4e6 — Environment-variable access.

pkgs/python/[email protected]/pyarrow/__init__.py:409

    pkg_config_executable = _os.environ.get('PKG_CONFIG') or 'pkg-config'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13ce0a09f943f93d — Environment-variable access.

pkgs/python/[email protected]/pyarrow/__init__.py:441

    if _os.environ.get('ARROW_HOME'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91e5cef3f4dffb95 — Environment-variable access.

pkgs/python/[email protected]/pyarrow/__init__.py:442

        append_library_dir(_os.path.join(_os.environ['ARROW_HOME'], 'lib'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2822aa8b79922ab0 — Environment-variable access.

pkgs/python/[email protected]/pyarrow/ipc.py:138

        bool(int(os.environ.get('ARROW_PRE_0_15_IPC_FORMAT', '0')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bb3f1f409d27dda — Environment-variable access.

pkgs/python/[email protected]/pyarrow/ipc.py:139

    if bool(int(os.environ.get('ARROW_PRE_1_0_METADATA_VERSION', '0'))):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #b882221221d91bff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pyarrow/util.py:236

    with urlopen(req) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #aec9fb4e96d3d00f — Filesystem access.

pkgs/python/[email protected]/pyarrow/util.py:237

        with open(out_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #ac51aff8253f407d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pyarrow/util.py:243

    with requests.get(url) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #e4bc4651092a2321 — Filesystem access.

pkgs/python/[email protected]/pyarrow/util.py:244

        with open(out_path, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #63bcd3e3d0f796b6 — Filesystem access.

pkgs/python/[email protected]/scripts/update_stub_docstrings.py:200

        tree = libcst.parse_module(stub_file.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #97207da2e590e523 — Filesystem access.

pkgs/python/[email protected]/scripts/update_stub_docstrings.py:202

        stub_file.write_text(modified.code, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pydantic

python dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #917c18155226a4f2 — Filesystem access.

pkgs/python/[email protected]/pydantic/deprecated/parse.py:71

    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cce80718b1d4999f — Environment-variable access.

pkgs/python/[email protected]/pydantic/json_schema.py:344

                if os.getenv('PYDANTIC_PRIVATE_ALLOW_UNHANDLED_SCHEMA_TYPES'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c79e9b7d648ea4c — Filesystem access.

pkgs/python/[email protected]/pydantic/mypy.py:1411

    with open(config_file, 'rb') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38edde9418991e0e — Environment-variable access.

pkgs/python/[email protected]/pydantic/plugin/_loader.py:27

    disabled_plugins = os.getenv('PYDANTIC_DISABLE_PLUGINS')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5361e1205b33415d — Environment-variable access.

pkgs/python/[email protected]/pydantic/v1/env_settings.py:173

            env_vars: Mapping[str, Optional[str]] = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #840141c2e0528e54 — Environment-variable access.

pkgs/python/[email protected]/pydantic/v1/env_settings.py:175

            env_vars = {k.lower(): v for k, v in os.environ.items()}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b296e427e356e16d — Filesystem access.

pkgs/python/[email protected]/pydantic/v1/env_settings.py:307

                    secret_value = path.read_text().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7db7d058718ce693 — Filesystem access.

pkgs/python/[email protected]/pydantic/v1/mypy.py:948

    with open(config_file, read_mode) as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39e57578851d7eb3 — Filesystem access.

pkgs/python/[email protected]/pydantic/v1/parse.py:57

    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pydantic-settings

python dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #a2aa84c849aa9cc9 — Environment-variable access.

pkgs/python/[email protected]/pydantic_settings/sources/providers/env.py:75

        return parse_env_vars(os.environ, self.case_sensitive, self.env_ignore_empty, self.env_parse_none_str)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61b47bc2465b4839 — Filesystem access.

pkgs/python/[email protected]/pydantic_settings/sources/providers/nested_secrets.py:203

        return {str(p.relative_to(path)): p.read_text().strip() for p in cls._iter_secret_files(path)}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75063386b2f8d9f1 — Filesystem access.

pkgs/python/[email protected]/pydantic_settings/sources/providers/secrets.py:122

                    return path.read_text().strip(), field_key, value_is_complex

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pymongo

python dependency

expand_more 117 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #0a42b17ca4fd0b03 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:292

    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #03aa9c9f493e34c5 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:321

    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9cad38ce32e023e6 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:354

    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #eeffd3059c1c2a45 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:64

    base_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7b686712cf7ab884 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:99

            os.environ["AZUREKMS_VMNAME_PREFIX"] = "PYTHON_DRIVER"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ddc1ab3fcf703da9 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102

            os.environ[

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #494b2f45ae94fcc2 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102

            os.environ[
                "AZUREKMS_IMAGE"
            ] = "Canonical:0001-com-ubuntu-server-jammy:22_04-lts-gen2:latest"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b613bc43ea686a85 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:106

            os.environ["GCPKMS_IMAGEFAMILY"] = "debian-12"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #571d4b34fb4fa36c — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:128

        key_name = os.environ["KEY_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4ddf5a2278e09053 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:129

        key_vault_endpoint = os.environ["KEY_VAULT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #e8b83927b9cf6ee5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:17

            urllib.request.urlopen(url)  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #c48c770093718fc4 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:26

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0b295e222bee3c72 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:64

        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ac9097759765aa41 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:72

    uri1 = os.environ["TEST_URI1"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a81024606a4d5b69 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:73

    uri2 = os.environ["TEST_URI2"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cc7aa9391b421f00 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:81

        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #87f8e82cc3765744 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:86

    apache = os.environ["APACHE_BINARY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #39a68af59cf5c46f — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:87

    apache_config = os.environ["APACHE_CONFIG"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c28c1d238bf4dbb0 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:34

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bcfe79f14d5f4744 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:36

    if sub_test_name == "eks" and "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2a4fd5c3f62bb6f4 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:39

            if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b8acadb2d347bbb6 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:40

                write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3395cd77be9d16da — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:62

        return os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4f90037046cff193 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:84

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #531f7c66ba2068a1 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:63

    spec_dir = pathlib.Path(os.environ["MDB_SPECS"]) / "source"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8b8bafe5b0bdfe4f — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:126

            with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f787570235d5f10d — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:10

    os.environ[name] = str(value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #69c3ac92da82cc44 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:22

    if "VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #68625788a1d98b70 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:23

        os.environ["MONGODB_VERSION"] = os.environ["VERSION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #deedba0a0dbc8803 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:32

        os.environ["TOPOLOGY"] = "replica_set"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b03db3b98f5897fe — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:33

        os.environ["MONGODB_VERSION"] = "7.0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #eb7c2670f834d478 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:35

    if not os.environ.get("TEST_CRYPT_SHARED"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #50d75bd3f4c9e6c0 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:24

AUTH = os.environ.get("AUTH", "noauth")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5122b559747e20e3 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:25

SSL = os.environ.get("SSL", "nossl")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b6668345bddcf230 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:26

UV_ARGS = os.environ.get("UV_ARGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9a9cc5fce3ee3343 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:27

TEST_PERF = os.environ.get("TEST_PERF")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #abfacba64cc13d29 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:28

GREEN_FRAMEWORK = os.environ.get("GREEN_FRAMEWORK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #45f8e49ebf83d584 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:29

TEST_ARGS = os.environ.get("TEST_ARGS", "").split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #044ef4b07d446cfb — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:30

TEST_NAME = os.environ.get("TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #12817b158e145e81 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:31

SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4e428ba19d1628fb — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:53

    with open("results.json") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3c547d006d8d3bb9 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:68

    with open("report.json", "w", newline="\n") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #194361d738f3ce1a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:106

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #56c465a3a92c809a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:150

    if not os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fa9cf5e5a0287127 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:153

    if os.environ.get("PYMONGOCRYPT_LIB"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c5c8d520f984c757 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:204

    if os.environ.get("DEBUG_LOG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #28209ed151cca02b — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:207

    if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1837b63e9f23ab0a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:57

    value = os.environ.get(var, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #653f614e5cfebd2c — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:65

    with open("/etc/os-release") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5f55e64788492a2e — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:111

        url = os.environ["LIBMONGOCRYPT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #41d3ad5b6150e7fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:116

    with request.urlopen(request.Request(url), timeout=15.0) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #8ad1443795b74896 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:181

            write_env(var, os.environ.get(var, getattr(opts, var.lower(), "")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #075ea75db6640886 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:200

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cdd200350b722b34 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:223

        if "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8eba46246c795ead — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:225

                if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7808f2ff98b91e54 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:226

                    write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bf3ed50db09eaada — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:268

            os.environ["KRB5_CONFIG"] = str(krb_conf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6738ae8ccace611a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281

        SINGLE_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #eb05a09861551efb — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281

        SINGLE_MONGOS_LB_URI = os.environ.get(
            "SINGLE_MONGOS_LB_URI", "mongodb://127.0.0.1:8000/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bb0cf4214298f4ce — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284

        MULTI_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #267f74335fbee624 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284

        MULTI_MONGOS_LB_URI = os.environ.get(
            "MULTI_MONGOS_LB_URI", "mongodb://127.0.0.1:8001/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #dacd316dca422613 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:304

            os.environ["OCSP_SERVER_TYPE"] = sub_test_name

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #08bad9c1a454d7e5 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:306

            if name not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f91e5282fcb5b894 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:309

        server_type = os.environ["OCSP_SERVER_TYPE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8c6dfe474b93a29e — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:310

        orch_file = os.environ["ORCHESTRATION_FILE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d6efaf13f2f6da86 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:321

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b75306d80835b837 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:328

        version = os.environ.get("VERSION", "latest")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3e71c5380dd1b65e — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:349

    compressors = os.environ.get("COMPRESSORS") or opts.compressor

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #caa46d7acd0b32f5 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:412

        if "AWS_ROLE_SESSION_NAME" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c3bc891a79ae5912 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:472

        framework = opts.green_framework or os.environ["GREEN_FRAMEWORK"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0604dc5a21dd119f — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:10

TEST_NAME = os.environ.get("TEST_NAME", "unconfigured")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8df936bbf7c11249 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:11

SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fc7bc4e61c2809ad — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:52

    Path(os.environ["OUTPUT_FILE"]).unlink(missing_ok=True)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9669863247c7493f — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:61

if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #84ac454c2a33b828 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:15

DRIVERS_TOOLS = os.environ.get("DRIVERS_TOOLS", "").replace(os.sep, "/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #79c300ba7945d23b — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:169

        if env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #857ec3bbeabd98c1 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:173

                opts.auth = os.environ.get("AUTH") == "auth"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b277bd4e58f46f21 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:175

                ssl_opt = os.environ.get("SSL", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7fab117ec62f8cef — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:178

                if os.environ[env_var]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #553c4e645985b8db — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:181

                setattr(opts, key, os.environ[env_var])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e76ff9380e25480b — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:211

    env = kwargs.pop("env", os.environ).copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31227042bbf293a1 — Environment-variable access.

pkgs/python/[email protected]/_setup.py:71

            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #198291ed29181361 — Environment-variable access.

pkgs/python/[email protected]/_setup.py:88

            if "ProgramFiles" in os.environ and "ProgramFiles(x86)" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c993b5f89171970 — Environment-variable access.

pkgs/python/[email protected]/_setup.py:89

                os.environ["ProgramFiles(x86)"] = os.environ["ProgramFiles"] + " (x86)"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90b552ac6171777b — Environment-variable access.

pkgs/python/[email protected]/_setup.py:94

            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #672d4df825df13b6 — Environment-variable access.

pkgs/python/[email protected]/_setup.py:127

if "--no_ext" in sys.argv or os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #9ca17a6b73c50751 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pymongo/_azure_helpers.py:36

        with urlopen(request, timeout=timeout) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9449d51b3e9cdc63 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pymongo/_gcp_helpers.py:29

        with urlopen(request, timeout=timeout) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ae3fbb529e254f26 — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:81

        token_file = os.environ.get("OIDC_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05f20b683586e38a — Filesystem access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:86

        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5097596e59d4a505 — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:92

        token_file = os.environ.get("AWS_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3651b3c54196958d — Filesystem access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:97

        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dd7240e03075f4e — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:129

        if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5886ca0aa1908f3b — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:130

            fname = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1814706b15b0181b — Filesystem access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:131

    with open(fname) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #579da2fe49a588b2 — Filesystem access.

pkgs/python/[email protected]/pymongo/common.py:238

    open(value).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bff63dd6e1f226c2 — Filesystem access.

pkgs/python/[email protected]/pymongo/daemon.py:64

            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f06b55293e281f8 — Filesystem access.

pkgs/python/[email protected]/pymongo/daemon.py:95

            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9582c2f187c81c3a — Environment-variable access.

pkgs/python/[email protected]/pymongo/logger.py:165

        document_length = int(os.getenv("MONGOB_LOG_MAX_DOCUMENT_LENGTH", _DEFAULT_DOCUMENT_LENGTH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #66afba59d6d80ce9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pymongo/ocsp_support.py:295

            response = _post(
                uri,
                data=ocsp_request.public_bytes(_Encoding.DER),
                headers={"Content-Type": "application/ocsp-request"},
                timeout=timeout,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #f4845d6de35a0860 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:78

        "architecture": os.environ.get("PROCESSOR_ARCHITECTURE") or platform.machine(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e2cec3935effdfc — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:119

    if os.getenv(ENV_VAR_K8S):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #290eca6eef42aaf3 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:126

    if os.getenv("AWS_LAMBDA_RUNTIME_API"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52bb5d09545e38d4 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:128

    env = os.getenv("AWS_EXECUTION_ENV")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f3f4602665c8ecf — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:135

    return bool(os.getenv("FUNCTIONS_WORKER_RUNTIME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c6bb6b1d33bc291 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:139

    return bool(os.getenv("K_SERVICE") or os.getenv("FUNCTION_NAME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3f1c77e874fd8e5 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:143

    return bool(os.getenv("VERCEL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9502962325d55865 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:152

    val = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0396b8f82855a12 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:171

        region = os.getenv("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3167840075cc7d32 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:181

        region = os.getenv("FUNCTION_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #535d8d29564cac46 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:192

        region = os.getenv("VERCEL_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #03a3d60fa86676e4 — Filesystem access.

pkgs/python/[email protected]/tools/compare_import_time.py:23

    with open(f"pymongo-{sha}.log") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0a2b5a39e348b3a6 — Filesystem access.

pkgs/python/[email protected]/tools/convert_test_to_async.py:123

    with open(input_file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d2f06a7299c10785 — Filesystem access.

pkgs/python/[email protected]/tools/convert_test_to_async.py:127

        with open(output_file, "w+") as f2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8633ee4ac149bdce — Filesystem access.

pkgs/python/[email protected]/tools/ensure_future_annotations_import.py:29

        with open(path) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ee193bcba0f4025a — Filesystem access.

pkgs/python/[email protected]/tools/synchro.py:290

            with open(file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #61001c5ead76fe62 — Environment-variable access.

pkgs/python/[email protected]/tools/synchro.py:442

            and "OVERRIDE_SYNCHRO_CHECK" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pyodbc

python dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #3121569b6ddc68ae — Filesystem access.

pkgs/python/[email protected]/setup.py:19

    text = path.read_text(encoding='utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6af571204d1b48a — Environment-variable access.

pkgs/python/[email protected]/setup.py:120

    elif os.environ.get("OS", '').lower().startswith('windows'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b37164e9f669cecc — Environment-variable access.

pkgs/python/[email protected]/setup.py:150

            _HOMEBREW_PREFIX = os.environ.get('HOMEBREW_PREFIX')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

qdrant-client

python dependency

expand_more 13 low-confidence finding(s)

low egress dependency Excluded from app score #fd10b14470967c96 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/qdrant_client/common/version_check.py:15

    response = httpx.get(rest_uri, headers=rest_headers, auth=auth_provider, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #39ea25ff53b77cb6 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/embed/schema_parser.py:298

        with open(output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c55d3f5104809499 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/embed/utils.py:76

    with open(path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3e3346bdd5a0088 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:99

            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #350d561d3a06ceda — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:102

            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8147a0a0f0ccde8 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:125

            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8f280df0fd91277 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:127

        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df22b06c65b2e236 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:146

        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82e1e075c9ec3659 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:102

            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10894cf8fcaee167 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:105

            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afad0c3b1d5d051a — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:136

            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9036fec26e2276f9 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:138

        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d8ac32d7778427c — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:162

        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redisvl

python dependency

expand_more 39 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #8a10435195961039 — Filesystem access.

pkgs/python/[email protected]/docs/_extension/gallery_directive.py:69

            yaml_string = path_data.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #452f782d0e298caa — Filesystem access.

pkgs/python/[email protected]/doctests/query_vector.py:27

with open("data/query_vector.json") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6ca468732897df4 — Environment-variable access.

pkgs/python/[email protected]/redisvl/cli/utils.py:66

    env_address = os.getenv(REDIS_URL_ENV_VAR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a6ff401778c3dbb — Filesystem access.

pkgs/python/[email protected]/redisvl/extensions/router/semantic.py:700

        with open(fp, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #70294e9d197300ec — Filesystem access.

pkgs/python/[email protected]/redisvl/extensions/router/semantic.py:731

        with open(fp, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4944d634db091044 — Environment-variable access.

pkgs/python/[email protected]/redisvl/mcp/config.py:576

        env_value = os.environ.get(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #494dfcfaeae2fdd8 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/backup.py:127

        with open(header_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #336cb7e8759cde1c — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/backup.py:175

        with open(self._data_path, "ab") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80d9b816f6ecdba7 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/backup.py:268

        with open(self._data_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53bfbef356e9beb4 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/backup.py:377

        with open(manifest_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ca981e080105e50 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/batch_executor.py:342

        with open(tmp_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52b9d54a300575f9 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/batch_executor.py:352

        with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #065120ac89190cab — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/batch_executor.py:361

        with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b17af3177255a23 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/batch_planner.py:159

        with open(path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c15a9d8ce2268d67 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/batch_planner.py:361

        with open(plan_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6459896c5d24d3b — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/planner.py:243

        with open(patch_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e480294ca905267 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/planner.py:646

        with open(plan_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #226ec94e0c99ed08 — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/utils.py:44

    with open(resolved, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #630dbee7e4e3ad3b — Filesystem access.

pkgs/python/[email protected]/redisvl/migration/utils.py:50

    with open(resolved, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd104dc9b36281dc — Environment-variable access.

pkgs/python/[email protected]/redisvl/redis/connection.py:195

    redis_url = os.getenv(REDIS_URL_ENV_VAR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #136d70163ba5fb57 — Filesystem access.

pkgs/python/[email protected]/redisvl/schema/schema.py:260

        with open(fp, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36d1754e3d3f1b29 — Filesystem access.

pkgs/python/[email protected]/redisvl/schema/schema.py:496

        with open(fp, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a16e23557088a55d — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/rerank/cohere.py:93

            api_config.get("api_key") if api_config else os.getenv("COHERE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a9d454800b7d8f2 — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/rerank/voyageai.py:92

            api_config.get("api_key") if api_config else os.getenv("VOYAGE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d05f48be585af07 — Filesystem access.

pkgs/python/[email protected]/redisvl/utils/stopwords.py:15

    data = resources.files(__package__).joinpath("stopwords.json").read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57cfde4827a7cb03 — Filesystem access.

pkgs/python/[email protected]/redisvl/utils/vectorize/base.py:569

            return content.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2af633c926caeaa — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/bedrock.py:160

            "aws_access_key_id", os.getenv("AWS_ACCESS_KEY_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cb5878c9d0742d4 — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/bedrock.py:163

            "aws_secret_access_key", os.getenv("AWS_SECRET_ACCESS_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ed71162b0d052fc — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/bedrock.py:165

        aws_region = api_config.get("aws_region", os.getenv("AWS_REGION", "us-east-1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab5abe3f943fb60c — Filesystem access.

pkgs/python/[email protected]/redisvl/utils/vectorize/bedrock.py:309

            return {"inputImage": self._b64encode_image(content.read_bytes())}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8158a5f86b2b654b — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/text/azureopenai.py:148

            else os.getenv("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dff83f1857e98a89 — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/text/azureopenai.py:160

            else os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #201939c8531dc3f6 — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/text/azureopenai.py:172

            else os.getenv("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22b991af9a3af81d — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/text/cohere.py:145

            api_config.get("api_key") if api_config else os.getenv("COHERE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #863cdf5e4bed0b5f — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/text/mistral.py:135

            api_config.get("api_key") if api_config else os.getenv("MISTRAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #344138325d552351 — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/text/openai.py:134

            api_config.pop("api_key") if api_config else os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51f0d441b191251e — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/vertexai.py:173

            api_config.get("project_id") if api_config else os.getenv("GCP_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1cb252425ab46be — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/vertexai.py:176

            api_config.get("location") if api_config else os.getenv("GCP_LOCATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67b9d1bd235d6def — Environment-variable access.

pkgs/python/[email protected]/redisvl/utils/vectorize/voyageai.py:212

            api_config.get("api_key") if api_config else os.getenv("VOYAGE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sentence-transformers

python dependency

expand_more 58 low-confidence finding(s)

low env_fs dependency Excluded from app score #25714c46d7b7ed46 — Environment-variable access.

pkgs/python/[email protected]/sentence_transformers/__init__.py:45

if importlib.util.find_spec("codecarbon") and "CODECARBON_LOG_LEVEL" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b04ea682e4c32b0 — Environment-variable access.

pkgs/python/[email protected]/sentence_transformers/__init__.py:46

    os.environ["CODECARBON_LOG_LEVEL"] = "error"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #409e99ad8fc315be — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/backend/load.py:155

            with open(ov_config, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e420b0186b8db051 — Environment-variable access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:182

            cache_folder = os.getenv("SENTENCE_TRANSFORMERS_HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fca1c734abeb9b2 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:634

        with open(os.path.join(path, "config_sentence_transformers.json"), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7119a0f5aa0b4c1 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:679

        with open(os.path.join(path, "modules.json"), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b199f878e6ba3bb — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:771

        with open(os.path.join(path, "README.md"), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0af53baa4c2f97c5 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:1076

            with open(config_sentence_transformers_json_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e860fdb99f16a38a — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:1110

                with open(model_card_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #041e89940bd4fd87 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:1124

        with open(modules_json_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44d9a1cdcd8c3029 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/model.py:1318

        with open(config_sentence_transformers_json_path, encoding="utf8") as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8830960270acc11 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/modules/module.py:211

        with open(config_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #946343ab7b4f77bf — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/modules/module.py:406

        with open(config_output_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8abf180b168c0ddd — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/modules/router.py:567

        with open(os.path.join(output_path, self.config_file_name), "w", encoding="utf8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0010315296b1262b — Environment-variable access.

pkgs/python/[email protected]/sentence_transformers/base/trainer.py:295

            os.environ.setdefault("WANDB_PROJECT", "sentence-transformers")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33e1b541b4dff24e — Environment-variable access.

pkgs/python/[email protected]/sentence_transformers/base/trainer.py:299

            os.environ.setdefault("TRACKIO_PROJECT", "sentence-transformers")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c55842b75576f8d7 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/base/trainer.py:1037

                with open(index_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3e45cbc99b86b2d — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/classification.py:180

            with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b812e4c99518bb8d — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/correlation.py:129

            with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f0e1439eed43fe5 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/nano_beir.py:283

                fOut = open(csv_path, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2273d4baa15e7eca — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/nano_beir.py:288

                fOut = open(csv_path, mode="a", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cd44ec9f72c44a1 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/cross_encoder/evaluation/reranking.py:301

            with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dbceb905a00567c — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/datasets/parallel_sentences.py:96

            else open(filepath, encoding="utf8") as fIn

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1abf26c3dfd0206a — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/binary_classification.py:195

                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cf88f09f0f16b4d — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/binary_classification.py:200

                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22019ff117be0956 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/embedding_similarity.py:207

            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a8a7fd5e8b77818 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/information_retrieval.py:250

                fOut = open(csv_path, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72ae7e6a19a55a32 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/information_retrieval.py:255

                fOut = open(csv_path, mode="a", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e6267773172ab24 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/information_retrieval.py:388

                with open(json_path, mode=mode, encoding="utf-8") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2bc9101053290e5 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/label_accuracy.py:84

                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67ec6e9401deae1d — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/label_accuracy.py:89

                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ec61062154d7370 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/mse.py:122

            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db3aa4fd89253802 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/mse_from_dataframe.py:110

            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b11dcd8315ea8593 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/nano_beir.py:353

                fOut = open(csv_path, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #60eefbe49cc270c3 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/nano_beir.py:358

                fOut = open(csv_path, mode="a", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c9eec219588f69c — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/paraphrase_mining.py:224

                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8fcc5e26f97623d — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/paraphrase_mining.py:229

                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af8678a5e0677711 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/reranking.py:186

            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #653765e48f77a312 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/translation.py:157

            with open(csv_path, newline="", mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff018ba7623034b0 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/triplet.py:220

                with open(csv_path, newline="", mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8969cecf8e27b530 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/evaluation/triplet.py:226

                with open(csv_path, newline="", mode="a", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d73eaa1e6762a3a — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/phrase.py:105

        with open(os.path.join(output_path, "phrasetokenizer_config.json"), "w") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbb6d99ad869ee8c — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/phrase.py:119

        with open(os.path.join(input_path, "phrasetokenizer_config.json")) as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba6e9b9a96b725ac — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/whitespace.py:63

        with open(os.path.join(output_path, "whitespacetokenizer_config.json"), "w") as fOut:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e78aa06f3fe30862 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/tokenizer/whitespace.py:75

        with open(os.path.join(input_path, "whitespacetokenizer_config.json")) as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21389e171321c8ef — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/modules/word_embeddings.py:162

            else open(embeddings_file_path, encoding="utf8") as fIn

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbf391d69d0e5f9f — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/label_sentence.py:35

        for line in open(os.path.join(self.folder, filename), encoding="utf-8"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7344d83e193b83a — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/paired_files.py:30

                else open(filepath, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6178decf1979b732 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/sts_data.py:54

            else open(filepath, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aea076596ff558fc — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sentence_transformer/readers/triplet.py:44

            open(os.path.join(self.dataset_folder, filename), encoding="utf-8"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4432194a3fd885c5 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sparse_encoder/evaluation/reciprocal_rank_fusion.py:287

                with open(csv_path, mode="a" if output_file_exists else "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57b4e2e45d7e2ed5 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sparse_encoder/evaluation/reciprocal_rank_fusion.py:311

                with open(json_path, mode="w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d588181722e21424 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/sparse_encoder/modules/sparse_static_embedding.py:143

        with open(json_path) as fIn:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c81824d5a88a972a — Environment-variable access.

pkgs/python/[email protected]/sentence_transformers/util/environment.py:62

        if "LOCAL_RANK" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b244c3a8db4e1254 — Environment-variable access.

pkgs/python/[email protected]/sentence_transformers/util/environment.py:63

            local_rank = int(os.environ["LOCAL_RANK"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90aaa50d1ad67d74 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/util/file_io.py:243

            with open(download_filepath, "wb") as file_binary:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb155b97aed35c53 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/util/misc.py:201

    with open(csv_path, newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a40d5b8183715b6 — Filesystem access.

pkgs/python/[email protected]/sentence_transformers/util/misc.py:210

        with open(csv_path, "w", newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

typing-extensions

python dependency

expand_more 7 low-confidence finding(s)

low env_fs dependency Excluded from app score #fa2ef7a31d9d898c — Filesystem access.

pkgs/python/[email protected]/src/test_typing_extensions.py:1698

            Path(tempdir, "ann_module.py").write_text(ANN_MODULE_SOURCE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6146427da6fed101 — Filesystem access.

pkgs/python/[email protected]/src/test_typing_extensions.py:1699

            Path(tempdir, "ann_module2.py").write_text(ANN_MODULE_2_SOURCE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1e0cae041fe30f7 — Filesystem access.

pkgs/python/[email protected]/src/test_typing_extensions.py:1700

            Path(tempdir, "ann_module3.py").write_text(ANN_MODULE_3_SOURCE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #736babb975b6ce22 — Filesystem access.

pkgs/python/[email protected]/src/test_typing_extensions.py:8783

            Path(tempdir, "inspect_stock_annotations.py").write_text(STOCK_ANNOTATIONS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97f072c4bfee3a62 — Filesystem access.

pkgs/python/[email protected]/src/test_typing_extensions.py:8784

            Path(tempdir, "inspect_stringized_annotations.py").write_text(STRINGIZED_ANNOTATIONS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5dcd8bc3fe7eba83 — Filesystem access.

pkgs/python/[email protected]/src/test_typing_extensions.py:8785

            Path(tempdir, "inspect_stringized_annotations_2.py").write_text(STRINGIZED_ANNOTATIONS_2)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3cfae4cd75b1087 — Filesystem access.

pkgs/python/[email protected]/src/test_typing_extensions.py:9234

            Path(tempdir, "inspect_stringized_annotations_pep_695.py").write_text(STRINGIZED_ANNOTATIONS_PEP_695)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

weaviate-client

python dependency

expand_more 41 low-confidence finding(s)

low env_fs dependency Excluded from app score #fcffca55064295b3 — Environment-variable access.

pkgs/python/[email protected]/integration/conftest.py:358

        api_key = os.environ.get("OPENAI_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b084413861eea86 — Environment-variable access.

pkgs/python/[email protected]/integration/conftest.py:405

        api_key = os.environ.get("OPENAI_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #a2de8936dc6bd44e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/integration/test_auth.py:26

    response = httpx.get("http://" + url + "/v1/.well-known/openid-configuration")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #d88719800ffa3974 — Environment-variable access.

pkgs/python/[email protected]/integration/test_auth.py:47

    client_secret = os.environ.get(env_variable_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5640fa60548579c — Environment-variable access.

pkgs/python/[email protected]/integration/test_auth.py:101

    pw = os.environ.get(env_variable_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8d465ab73a635721 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/integration/test_auth.py:143

    weaviate_open_id_config = httpx.get("http://" + url + "/v1/.well-known/openid-configuration")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #db5a346fee2be677 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/integration/test_auth.py:149

    response_auth = httpx.get(href)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #592162594443e6cf — Environment-variable access.

pkgs/python/[email protected]/integration/test_auth.py:188

    pw = os.environ.get(env_variable_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aed67e6ce32df0f5 — Environment-variable access.

pkgs/python/[email protected]/integration/test_auth.py:207

    pw = os.environ.get("OKTA_DUMMY_CI_PW")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #760c418cbf153e28 — Environment-variable access.

pkgs/python/[email protected]/integration/test_client.py:700

    with mock.patch.dict(os.environ, {"PYPI_PACKAGE_URL": "http://does-not-exist"}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7510c2ed6451a56b — Environment-variable access.

pkgs/python/[email protected]/integration/test_client.py:707

    with mock.patch.dict(os.environ, {"PYPI_PACKAGE_URL": "http://does-not-exist"}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #798b0fa204268f13 — Environment-variable access.

pkgs/python/[email protected]/integration/test_collection_openai.py:584

    api_key = os.environ.get("COHERE_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2dcae56824d5c329 — Environment-variable access.

pkgs/python/[email protected]/integration/test_collection_openai.py:750

    api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfd87ddee915bf2a — Environment-variable access.

pkgs/python/[email protected]/integration/test_collection_openai.py:794

    api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc1273baaafa56d3 — Environment-variable access.

pkgs/python/[email protected]/integration/test_collection_openai.py:837

    contextual_api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c3cf7789e01fb1b — Environment-variable access.

pkgs/python/[email protected]/integration/test_collection_rerank.py:31

    api_key = os.environ.get("COHERE_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee1c905b031706da — Environment-variable access.

pkgs/python/[email protected]/integration/test_collection_rerank.py:85

    api_key = os.environ.get("COHERE_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4879a236e9a35eaa — Environment-variable access.

pkgs/python/[email protected]/integration/test_collection_rerank.py:145

    api_key = os.environ.get("CONTEXTUAL_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9ed52bf11583008 — Environment-variable access.

pkgs/python/[email protected]/integration/test_vectors.py:866

    api_key = os.environ.get("JINAAI_APIKEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #862c6ab41cc8e731 — Filesystem access.

pkgs/python/[email protected]/profiling/test_shutdown.py:48

    with open("uuids.json", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e16361536cc80312 — Filesystem access.

pkgs/python/[email protected]/profiling/test_sphere.py:33

        with open(sphere_file) as jsonl_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07afb3da356e6406 — Filesystem access.

pkgs/python/[email protected]/profiling/test_sphere.py:82

        with open(sphere_file) as jsonl_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7cc56df04f72110d — Filesystem access.

pkgs/python/[email protected]/tools/stubs.py:177

            with open(file, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fd112694ba8ae56 — Environment-variable access.

pkgs/python/[email protected]/weaviate/__init__.py:50

os.environ["GRPC_VERBOSITY"] = "ERROR"  # https://github.com/danielmiessler/fabric/discussions/754

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab22d258730a0e19 — Environment-variable access.

pkgs/python/[email protected]/weaviate/collections/batch/base.py:61

    os.getenv("WEAVIATE_BATCH_MAX_RETRIES", "9.299")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #425896ed0c61646e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/weaviate/connect/authentication.py:129

                    return resp(await client.get(self._open_id_config_url))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e4d9253e41dd5d24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/weaviate/connect/authentication.py:137

            return resp(client.get(self._open_id_config_url))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #5cd2238d00c58a51 — Environment-variable access.

pkgs/python/[email protected]/weaviate/connect/base.py:202

    http_proxy = (os.environ.get("HTTP_PROXY"), os.environ.get("http_proxy"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #334e4598d7da9222 — Environment-variable access.

pkgs/python/[email protected]/weaviate/connect/base.py:203

    https_proxy = (os.environ.get("HTTPS_PROXY"), os.environ.get("https_proxy"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20e6be088b3c66cf — Environment-variable access.

pkgs/python/[email protected]/weaviate/connect/base.py:204

    grpc_proxy = (os.environ.get("GRPC_PROXY"), os.environ.get("grpc_proxy"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #649cb28592a6d20b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/weaviate/connect/v4.py:408

                        response = await client.get(oidc_url, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c58138f5f73d730d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/weaviate/connect/v4.py:423

                response = client.get(oidc_url, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #819cd478673d95d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/weaviate/connect/v4.py:753

                        res = await client.get(PYPI_PACKAGE_URL, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a4bc22d8869eaa37 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/weaviate/connect/v4.py:762

                res = client.get(PYPI_PACKAGE_URL, timeout=self.timeout_config.init)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #77bb488360060d5f — Environment-variable access.

pkgs/python/[email protected]/weaviate/embedded.py:38

    persistence_data_path: str = os.environ.get("XDG_DATA_HOME", DEFAULT_PERSISTENCE_DATA_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f079b6a03d81d7c4 — Environment-variable access.

pkgs/python/[email protected]/weaviate/embedded.py:39

    binary_path: str = os.environ.get("XDG_CACHE_HOME", DEFAULT_BINARY_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #85ab76d68e0c8c6d — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/weaviate/embedded.py:91

            response = httpx.get("https://api.github.com/repos/weaviate/weaviate/releases/latest")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #d584dcd25657f42d — Environment-variable access.

pkgs/python/[email protected]/weaviate/embedded.py:205

        my_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc44636169864790 — Environment-variable access.

pkgs/python/[email protected]/weaviate/logger.py:5

logger.setLevel(os.getenv("WEAVIATE_LOG_LEVEL", "INFO"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc720ec5d592434a — Filesystem access.

pkgs/python/[email protected]/weaviate/util.py:83

        with open(image_or_image_path, "br") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b79fc376c5d7f161 — Filesystem access.

pkgs/python/[email protected]/weaviate/util.py:126

            file = open(file_or_file_path, "br")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

websockets

python dependency

expand_more 24 low-confidence finding(s)

low env_fs dependency Excluded from app score #71898beb61e145ee — Filesystem access.

pkgs/python/[email protected]/setup.py:10

exec((root_dir / "src" / "websockets" / "version.py").read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9a4715abf76c0d1 — Filesystem access.

pkgs/python/[email protected]/setup.py:16

    (root_dir / "README.rst").read_text(encoding="utf-8"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a03ecb6cc7a54cd0 — Environment-variable access.

pkgs/python/[email protected]/setup.py:22

if os.environ.get("BUILD_EXTENSION") == "no":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa7daf4af2e46c66 — Environment-variable access.

pkgs/python/[email protected]/setup.py:29

            optional=os.environ.get("BUILD_EXTENSION") != "yes",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b2b034539b254f8 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/asyncio/client.py:39

MAX_REDIRECTS = int(os.environ.get("WEBSOCKETS_MAX_REDIRECTS", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a449996060bacd3f — Environment-variable access.

pkgs/python/[email protected]/src/websockets/client.py:353

BACKOFF_INITIAL_DELAY = float(os.environ.get("WEBSOCKETS_BACKOFF_INITIAL_DELAY", "5"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7eedc87a507fff5c — Environment-variable access.

pkgs/python/[email protected]/src/websockets/client.py:354

BACKOFF_MIN_DELAY = float(os.environ.get("WEBSOCKETS_BACKOFF_MIN_DELAY", "3.1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44bb3b5bd1ed0b49 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/client.py:355

BACKOFF_MAX_DELAY = float(os.environ.get("WEBSOCKETS_BACKOFF_MAX_DELAY", "90.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e899f751839fb133 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/client.py:356

BACKOFF_FACTOR = float(os.environ.get("WEBSOCKETS_BACKOFF_FACTOR", "1.618"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a2bd84a48123b44 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/frames.py:148

    MAX_LOG_SIZE = int(os.environ.get("WEBSOCKETS_MAX_LOG_SIZE", "75"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9e2025561d4bd8f — Environment-variable access.

pkgs/python/[email protected]/src/websockets/http11.py:27

USER_AGENT = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e20ce5e8728602c — Environment-variable access.

pkgs/python/[email protected]/src/websockets/http11.py:27

USER_AGENT = os.environ.get(
    "WEBSOCKETS_USER_AGENT",
    f"Python/{PYTHON_VERSION} websockets/{websockets_version}",
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0e40ef7f00ee92d — Environment-variable access.

pkgs/python/[email protected]/src/websockets/http11.py:33

SERVER = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29478868bbbf90ed — Environment-variable access.

pkgs/python/[email protected]/src/websockets/http11.py:33

SERVER = os.environ.get(
    "WEBSOCKETS_SERVER",
    f"Python/{PYTHON_VERSION} websockets/{websockets_version}",
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c02667588077d03a — Environment-variable access.

pkgs/python/[email protected]/src/websockets/http11.py:39

MAX_NUM_HEADERS = int(os.environ.get("WEBSOCKETS_MAX_NUM_HEADERS", "128"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bde9335109d88898 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/http11.py:43

MAX_LINE_LENGTH = int(os.environ.get("WEBSOCKETS_MAX_LINE_LENGTH", "8192"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66a7e01b35d1c31a — Environment-variable access.

pkgs/python/[email protected]/src/websockets/http11.py:47

MAX_BODY_SIZE = int(os.environ.get("WEBSOCKETS_MAX_BODY_SIZE", "1_048_576"))  # 1 MiB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8100fe72dc63037e — Environment-variable access.

pkgs/python/[email protected]/src/websockets/legacy/client.py:417

    MAX_REDIRECTS_ALLOWED = int(os.environ.get("WEBSOCKETS_MAX_REDIRECTS", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1de3902be525573a — Environment-variable access.

pkgs/python/[email protected]/src/websockets/legacy/client.py:602

    BACKOFF_INITIAL = float(os.environ.get("WEBSOCKETS_BACKOFF_INITIAL_DELAY", "5"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72b850520057bdae — Environment-variable access.

pkgs/python/[email protected]/src/websockets/legacy/client.py:603

    BACKOFF_MIN = float(os.environ.get("WEBSOCKETS_BACKOFF_MIN_DELAY", "3.1"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7844cc9fade5597 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/legacy/client.py:604

    BACKOFF_MAX = float(os.environ.get("WEBSOCKETS_BACKOFF_MAX_DELAY", "90.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0ede518086dd1b6 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/legacy/client.py:605

    BACKOFF_FACTOR = float(os.environ.get("WEBSOCKETS_BACKOFF_FACTOR", "1.618"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #595a13ead2f96758 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/legacy/http.py:13

MAX_NUM_HEADERS = int(os.environ.get("WEBSOCKETS_MAX_NUM_HEADERS", "128"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1b52da54d538ff3 — Environment-variable access.

pkgs/python/[email protected]/src/websockets/legacy/http.py:14

MAX_LINE_LENGTH = int(os.environ.get("WEBSOCKETS_MAX_LINE_LENGTH", "8192"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

⚠ Higher-risk dependencies not analyzed

These higher-risk dependencies were not analyzed in this scan — treat the verdict as provisional. This is a scan-coverage limitation, not a detected data leak.

azure-ai-projects cloud — sdist exceeds byte cap

Skipped dependencies

Production

azure-ai-projects prod — sdist exceeds byte cap
scipy prod — sdist exceeds byte cap
faiss-cpu prod — no sdist (wheels only)
torch prod — no sdist (wheels only)
pymilvus prod — no sdist (wheels only)
milvus prod — no sdist (wheels only)
onnxruntime prod — no sdist (wheels only)
onnxruntime-genai prod — no sdist (wheels only)
usearch prod — no sdist (wheels only)
python-dotenv prod — scan budget exceeded
anyio prod — scan budget exceeded
sse-starlette prod — scan budget exceeded
uvicorn prod — scan budget exceeded

verified_user Possible application data leak

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz Potential data exfiltration in application code

</> First-Party Code

first-party (python): python

first-party (python): python/samples/demos/mcp_with_oauth/server

</> Dependencies

opentelemetry-sdk

azure-search-documents

google-cloud-aiplatform

opentelemetry-api

azure-core-tracing-opentelemetry

azure-ai-agents

mistralai

chromadb

semantic-kernel

redis

azure-ai-inference

azure-cosmos

azure-identity

ipykernel

mcp

transformers

aiohttp

aiortc

anthropic

autogen-agentchat

boto3

click

defusedxml

google-genai

httpx

jinja2

microsoft-agents-activity

microsoft-agents-copilotstudio-client

motor

numpy

ollama

openai

oracledb

pandas

pinecone

prance

psycopg

pyarrow

pydantic

pydantic-settings

pymongo

pyodbc

qdrant-client

redisvl

sentence-transformers

typing-extensions

weaviate-client

websockets

⚠ Higher-risk dependencies not analyzed

Skipped dependencies