Close Open Privacy Scan

link https://github.com/nadeem-shaikh/treehouse
bolt Snapshot: commit 67f31ce
science engine v1
schedule 2026-06-23T18:06:30.721678+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 162 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 162 low
First-party packages: 1
Dependency packages: 5
Ecosystem: go

swap_horiz Application data flows

No high- or medium-confidence application data-flow findings in this scan.

</> First-Party Code

first-party (go)

go first-party
expand_more 24 low-confidence finding(s)
low env_fs production #b1817acdf4a968c6 — Environment-variable access.
repo/cmd/get.go:114 
		holder = os.Getenv("TREEHOUSE_LEASE_HOLDER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13c469af3c875ac9 — Filesystem access.
repo/cmd/init.go:30 
		f, err := os.Create(dest)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0b5b55faaf38edf — Environment-variable access.
repo/cmd/return_cmd.go:72 
	if env := os.Getenv("TREEHOUSE_DIR"); env != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d5f989a46329f0da — Environment-variable access.
repo/cmd/root.go:33 
		if version == "dev" || os.Getenv("TREEHOUSE_NO_UPDATE_CHECK") == "1" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a297359b1c35b4e0 — Filesystem access.
repo/internal/config/gitignore.go:44 
	existing, err := os.ReadFile(gitignorePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3abef2bd98300e0f — Filesystem access.
repo/internal/config/gitignore.go:55 
	f, err := os.OpenFile(gitignorePath, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de030be8171d3654 — Environment-variable access.
repo/internal/hooks/command_windows.go:12 
	shell := os.Getenv("COMSPEC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6ec92d77e49318a — Filesystem access.
repo/internal/pool/prune.go:757 
	data, err := os.ReadFile(gitFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bada635d8d39835c — Filesystem access.
repo/internal/pool/state.go:42 
	data, err := os.ReadFile(stateFilePath(poolDir))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a3b38ad89e4229ef — Filesystem access.
repo/internal/pool/state.go:61 
	return os.WriteFile(stateFilePath(poolDir), data, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #636b220239972e1c — Filesystem access.
repo/internal/pool/state.go:70 
	f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_RDWR, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3483e7442bdb9dd7 — Environment-variable access.
repo/internal/shell/shell.go:10 
	shellPath := os.Getenv("SHELL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4a74d0b56448af2 — Environment-variable access.
repo/internal/shell/shell.go:13 
			shellPath = os.Getenv("COMSPEC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d376114191ca3f7 — Environment-variable access.
repo/internal/shell/shell.go:24 
	cmd.Env = append(os.Environ(), env...)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f43fb55b066122ae — Filesystem access.
repo/internal/updater/updater.go:117 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #55b2d7c78c28a950 — Filesystem access.
repo/internal/updater/updater.go:143 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6062666628fbd972 — Environment-variable access.
repo/internal/updater/updater.go:182 
	cmd.Env = append(os.Environ(), "TREEHOUSE_NO_UPDATE_CHECK=1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e988da518f53f902 — Filesystem access.
repo/internal/updater/updater.go:184 
	devNull, err := os.Open(os.DevNull)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fae4cd93161531c8 — Filesystem access.
repo/internal/updater/updater.go:378 
	return os.WriteFile(path, data, 0o644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1d418ef7a0d9c09 — Filesystem access.
repo/internal/updater/updater.go:411 
	f, err := os.Open(archivePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #04ce66af9364f6fb — Filesystem access.
repo/internal/updater/updater.go:480 
	f, err := os.Open(archivePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65b7b67e4341b83a — Filesystem access.
repo/internal/updater/updater.go:598 
	src, err := os.Open(newBinary)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4c79c3921e021997 — Filesystem access.
repo/internal/updater/updater.go:635 
	src, err := os.Open(newBinary)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9e79550f08bb30b4 — Filesystem access.
repo/internal/updater/updater.go:641 
	dst, err := os.OpenFile(target, os.O_WRONLY|os.O_TRUNC, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

github.com/BurntSushi/toml

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #8607828e4bba5bdd — Filesystem access.
pkgs/go/[email protected]/cmd/tomlv/main.go:48 
		fp, err := os.Open(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd02deac6503098f — Filesystem access.
pkgs/go/[email protected]/decode.go:41 
	fp, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/fatih/color

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #718ae7373c05e254 — Environment-variable access.
pkgs/go/[email protected]/color.go:22 
	NoColor = noColorIsSet() || os.Getenv("TERM") == "dumb" ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b63abd6c4ae5433 — Environment-variable access.
pkgs/go/[email protected]/color.go:40 
	return os.Getenv("NO_COLOR") != ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/shirou/gopsutil/v4

go dependency
expand_more 59 low-confidence finding(s)
low env_fs dependency Excluded from app score #4b4df775eb563361 — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu_plan9.go:22 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5dc8dfc1458a77e3 — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:550 
	if f, err := os.Open(udevDataPath); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e59e18e9ef56196 — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:582 
	model, _ := os.ReadFile(filepath.Join(devicePath, "model"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #829e34c903d3f344 — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:583 
	serial, _ := os.ReadFile(filepath.Join(devicePath, "serial"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7cf2b5faf5e91db2 — Filesystem access.
pkgs/go/[email protected]/disk/disk_linux.go:595 
		dmname, err := os.ReadFile(dmnameFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #781b249c1e0e0482 — Filesystem access.
pkgs/go/[email protected]/disk/disk_solaris.go:51 
	f, err := os.Open(_MNTTAB)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #acd014eeda462e3a — Filesystem access.
pkgs/go/[email protected]/host/host_darwin.go:54 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b2d1576d5b94a45 — Filesystem access.
pkgs/go/[email protected]/host/host_freebsd.go:52 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6631fea0c4b4118 — Filesystem access.
pkgs/go/[email protected]/host/host_freebsd.go:109 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a3499aba965b074a — Filesystem access.
pkgs/go/[email protected]/host/host_linux.go:84 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6be72ac6641296e — Filesystem access.
pkgs/go/[email protected]/host/host_openbsd.go:63 
	file, err := os.Open(utmpfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #82cd8b185198624f — Filesystem access.
pkgs/go/[email protected]/host/host_solaris.go:104 
	b, err := os.ReadFile("/etc/release")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35a691ba3f899608 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:94 
		return os.ReadFile(fpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26edb9fac0f50b43 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:105 
	content, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ab2f7b3d9b361ac — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:121 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e36272aca7783205 — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:149 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #846361d29a7ec3ee — Filesystem access.
pkgs/go/[email protected]/internal/common/common.go:234 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c246b28faf14566 — Environment-variable access.
pkgs/go/[email protected]/internal/common/common.go:352 
		value = os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #946b43b2d024d834 — Environment-variable access.
pkgs/go/[email protected]/internal/common/common.go:363 
	value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5bd28d255a8fb33f — Filesystem access.
pkgs/go/[email protected]/internal/common/common_linux.go:27 
	f, err := os.Open(HostProcWithContext(ctx))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8585aa0fd342cad — Filesystem access.
pkgs/go/[email protected]/load/load_linux.go:79 
	out, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #04e7927bcd373b14 — Filesystem access.
pkgs/go/[email protected]/load/load_linux.go:121 
	line, err := os.ReadFile(loadavgFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #628a3a75fcf23655 — Filesystem access.
pkgs/go/[email protected]/mem/mem_linux.go:476 
	f, err := os.Open(swapsFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e5b39ff64d04ff0 — Environment-variable access.
pkgs/go/[email protected]/mem/mem_plan9.go:20 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b700725e5271e912 — Environment-variable access.
pkgs/go/[email protected]/mem/mem_plan9.go:42 
	root := os.Getenv("HOST_ROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94482af23ad78f33 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:475 
	f, err := os.Open(dir)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ae1f4c71d4ddf1a — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:518 
	d, err := os.Open(common.HostProcWithContext(ctx))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #690c44c52f6b77eb — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:562 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd8e81bf4ed230e2 — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:681 
	contents, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0127ab2a1d0690e — Filesystem access.
pkgs/go/[email protected]/net/net_linux.go:742 
	contents, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cc3ac2b6fb30456 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:139 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a075b34e88a39628 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:348 
		statContents, err := os.ReadFile(statFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #44375d5ab43226b6 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:399 
	contents, err := os.ReadFile(smapsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38976eda8c72059a — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:494 
	environContent, err := os.ReadFile(environPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f000b2ec41766997 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:521 
	d, err := os.Open(limitsFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db9c259dc4ed9b1e — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:614 
	d, err := os.Open(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fee5297ab580021 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:678 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65f61b70574becd2 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:692 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05d9a736b9c4d943 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:715 
	ioline, err := os.ReadFile(ioPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bde9a79f19470910 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:755 
	contents, err := os.ReadFile(memPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #812f6f551b29bb5f — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:816 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfa5424143811225 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:833 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1aba9ed0ddde375 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:1040 
	contents, err := os.ReadFile(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69df536963f36379 — Filesystem access.
pkgs/go/[email protected]/process/process_linux.go:1168 
	d, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #29c36236f9db0f30 — Filesystem access.
pkgs/go/[email protected]/process/process_posix.go:31 
	d, err := os.Open(devPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #885973d7ca4d9506 — Filesystem access.
pkgs/go/[email protected]/process/process_posix.go:49 
	ptsd, err := os.Open(ptsPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40ecefdfe56b5fdc — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:203 
	d, err := os.Open(statPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fec5b3f428ce1ca — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:235 
	exe, err := os.ReadFile(execNamePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5ec822908c15c2fb — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:245 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8da66278c11a97e6 — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:259 
	cmdline, err := os.ReadFile(cmdPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #853efa961d62d1c2 — Filesystem access.
pkgs/go/[email protected]/process/process_solaris.go:281 
	d, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #359b44384e430056 — Filesystem access.
pkgs/go/[email protected]/sensors/ex_linux.go:52 
		if raw, _ = os.ReadFile(basepath + "_label"); len(raw) != 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #69d810b98533c486 — Filesystem access.
pkgs/go/[email protected]/sensors/ex_linux.go:58 
		if raw, err = os.ReadFile(filepath.Join(directory, "name")); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e64c1f2892f6d37 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:39 
			name, err := os.ReadFile(filepath.Join(file, "type"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee8dcec3057a237a — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:45 
			current, err := os.ReadFile(filepath.Join(file, "temp"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f1a8ccbac910240c — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:89 
		if raw, _ = os.ReadFile(basepath + "_label"); len(raw) != 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #12fca146d586630d — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:95 
		if raw, err = os.ReadFile(filepath.Join(directory, "name")); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c37dc8cbb0ddb96 — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:107 
		if raw, err = os.ReadFile(file); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c70a967068e4a8ad — Filesystem access.
pkgs/go/[email protected]/sensors/sensors_linux.go:163 
	if raw, err = os.ReadFile(filename); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/spf13/cobra

go dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #a47b8ee3299bcfb7 — Environment-variable access.
pkgs/go/[email protected]/active_help.go:48 
	activeHelpCfg := os.Getenv(activeHelpGlobalEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0ce8972fae2fb418 — Environment-variable access.
pkgs/go/[email protected]/active_help.go:50 
		activeHelpCfg = os.Getenv(activeHelpEnvVar(cmd.Root().Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91e98bd2ac437d4a — Filesystem access.
pkgs/go/[email protected]/bash_completions.go:702 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43e7a24c3ec67b9d — Filesystem access.
pkgs/go/[email protected]/bash_completionsV2.go:471 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e316ff2d73744f6f — Environment-variable access.
pkgs/go/[email protected]/completions.go:957 
	if path := os.Getenv("BASH_COMP_DEBUG_FILE"); path != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a8019d5652250a4 — Filesystem access.
pkgs/go/[email protected]/completions.go:958 
		f, err := os.OpenFile(path,
			os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65e4138e3d325729 — Environment-variable access.
pkgs/go/[email protected]/completions.go:1015 
	v := os.Getenv(configEnvVar(cmd.Root().Name(), suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a749c35668e9518 — Environment-variable access.
pkgs/go/[email protected]/completions.go:1017 
		v = os.Getenv(configEnvVar(configEnvVarGlobalPrefix, suffix))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81fc922717f15843 — Filesystem access.
pkgs/go/[email protected]/doc/man_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #581af7dc8105158e — Environment-variable access.
pkgs/go/[email protected]/doc/man_docs.go:127 
		if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #76a8db5f5e24f5c3 — Filesystem access.
pkgs/go/[email protected]/doc/md_docs.go:145 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea845b828136a74c — Filesystem access.
pkgs/go/[email protected]/doc/rest_docs.go:157 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08dc665c6ee0cdb3 — Filesystem access.
pkgs/go/[email protected]/doc/yaml_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6771604b13da1d1 — Filesystem access.
pkgs/go/[email protected]/fish_completions.go:285 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9b4711372aed7b4 — Filesystem access.
pkgs/go/[email protected]/powershell_completions.go:321 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a5383b0dcec7db2a — Filesystem access.
pkgs/go/[email protected]/zsh_completions.go:71 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

golang.org/x/sys

go dependency
expand_more 59 low-confidence finding(s)
low env_fs dependency Excluded from app score #ea88fdefda84d319 — Environment-variable access.
pkgs/go/[email protected]/cpu/cpu.go:271 
	env := os.Getenv("GODEBUG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77b25fd6d2214f16 — Filesystem access.
pkgs/go/[email protected]/cpu/hwcap_linux.go:42 
	buf, err := os.ReadFile(procAuxv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4abc72421ec45b3a — Filesystem access.
pkgs/go/[email protected]/cpu/proc_cpuinfo_linux.go:17 
	f, err := os.Open("/proc/cpuinfo")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1b324d5ce72f4778 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:90 
	goos := os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f736fa4c5bee1d24 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:91 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #036810cf8876570f — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:93 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #60ede6d041686808 — Environment-variable access.
pkgs/go/[email protected]/plan9/mksyscall.go:98 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8481568620f2e6fa — Filesystem access.
pkgs/go/[email protected]/plan9/mksyscall.go:127 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55edc737fea7ae4a — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:443 
		src, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59bcde309cb44ba7 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:467 
	f, err := os.Create(mergedFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81942e8a6e752447 — Filesystem access.
pkgs/go/[email protected]/unix/internal/mkmerge/mkmerge.go:494 
		err = os.WriteFile(inFile.name, src, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2a7296289607de5 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:182 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #283cd70a8506d860 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:317 
	if fmtCmd.Stdout, err = os.Create(outputFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #081aeded8df7b99e — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mkall.go:337 
	t.env = append(os.Environ(), fmt.Sprintf("%s=%s", "GOOS", GOOS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed37c3b6a045b466 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:447 
	if file, err := os.Create(stubsFile); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e2f7b9bbfa95a59 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:482 
	abiFile, err := os.Create(filepath.Join(abiDir, "abi.h"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2e847dec30ce6d4 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:631 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af06825f341e97bc — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:756 
	f, err := os.Create(fmt.Sprintf("zptrace_%s_linux.go", archName))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0c354bcbc32d1ba — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:784 
	f, err := os.Create(fmt.Sprintf("zptrace_linux_%s.go", arch))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f624b9ec853e0b5 — Filesystem access.
pkgs/go/[email protected]/unix/linux/mkall.go:819 
	data, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa5ef430d9925a70 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:100 
	goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba13ef563fc341c8 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:101 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3a6db1fe69c18fc — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:103 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ead84cd96aa404c1 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:111 
	if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bef889562ea9dd87 — Environment-variable access.
pkgs/go/[email protected]/unix/linux/mksysnum.go:117 
	cc := os.Getenv("CC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #db8accc585853aa5 — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:36 
		in, err := os.ReadFile(inFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c05a0079f465bb0d — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:73 
	if err := os.WriteFile(outFileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d819881847f2e8d — Filesystem access.
pkgs/go/[email protected]/unix/mkasm.go:110 
	if err := os.WriteFile(fileName, out.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8977c965fe874d8 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:26 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #108464985b6826e0 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:28 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #748d7cc305c18bd2 — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:30 
	goarch := os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f6a75bd5e19534f — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:32 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80122e7a5a157e8c — Environment-variable access.
pkgs/go/[email protected]/unix/mkpost.go:36 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #361c93d64275df2a — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:104 
	goos := os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #764d6829f91248e0 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:106 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df3051534c5f0978 — Environment-variable access.
pkgs/go/[email protected]/unix/mksyscall.go:115 
		if os.Getenv("GOLANG_SYS_BUILD") != "docker" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37e907765e32eb32 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall.go:145 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5a67ece19994bd8 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc.go:100 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f691c468a07a972b — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:148 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1fd34da082d4853d — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:521 
	err := os.WriteFile("zsyscall_aix_ppc64.go",
		[]byte(fmt.Sprintf(srcTemplate1, cmdLine(), goBuildTags(), pack, imp, textcommon)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1553ae67a27ab1c1 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:532 
	err = os.WriteFile("zsyscall_aix_ppc64_gc.go",
		[]byte(fmt.Sprintf(srcTemplate2, cmdLine(), goBuildTags(), pack, imp, dynimports, linknames, vardecls, textgc)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24e921ebe46cabb3 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_aix_ppc64.go:541 
	err = os.WriteFile("zsyscall_aix_ppc64_gccgo.go",
		[]byte(fmt.Sprintf(srcTemplate3, cmdLine(), goBuildTags(), pack, cExtern, imp, textgccgo)),
		0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcac7b91b3760eae — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_solaris.go:103 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8d37ce411bdcd6d — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:208 
	f, err := os.Open(*inputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ac4dbe14305e902 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:216 
	fasm, asmerr := os.Create(*outasm)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ef8b22b5393e211a — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:230 
	fgo, goerr := os.Create(*outputgo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51e72e78f37ae6a9 — Filesystem access.
pkgs/go/[email protected]/unix/mksyscall_zos_s390x.go:272 
	f, err := os.Create(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a23e9739b30ad154 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:122 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1080f5565cb8e36a — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:124 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6454133a37a8cb27 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:127 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b06fd9e120444a5b — Environment-variable access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:129 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #656fc5651189b193 — Filesystem access.
pkgs/go/[email protected]/unix/mksysctl_openbsd.go:259 
		file, err := os.Open(filepath.Join("/usr/include", header))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37e818301092ac7f — Filesystem access.
pkgs/go/[email protected]/unix/mksysnum.go:70 
	file, err := os.Open(os.Args[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06af9a1683cbdf99 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:90 
	goos = os.Getenv("GOOS_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08234714ac4c83b7 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:92 
		goos = os.Getenv("GOOS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dc29814188275218 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:95 
	goarch = os.Getenv("GOARCH_TARGET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51ff8998d5df8334 — Environment-variable access.
pkgs/go/[email protected]/unix/mksysnum.go:97 
		goarch = os.Getenv("GOARCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #138d6f67212fbed1 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:710 
	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09751ccad5a922c9 — Filesystem access.
pkgs/go/[email protected]/windows/mkwinsyscall/mkwinsyscall.go:894 
		err = os.WriteFile(*filename, data, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.