Close Open Privacy Scan

link https://github.com/pallets/click
bolt Snapshot: commit 7df2f82
science engine v1.14
schedule 2026-07-17T03:28:23.465622+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

Incomplete scan — only 1/2 dependencies were analyzed. Treat the score as provisional.

App Privacy Score

97 /100
Low privacy risk

Low risk · 67 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 67 low
First-party packages: 3
Dependency packages: 1
Ecosystem: python

swap_horiz External domains

click.palletsprojects.comdiscord.ggdocs.python.orgen.wikipedia.orggist.github.comgithub.compalletsprojects.compeps.python.orgpypi.org

</> First-Party Code

first-party (python)

python first-party
expand_more 33 low-confidence finding(s)
low env_fs production #e9f40c345de158f0 — Filesystem access.
repo/src/click/_compat.py:369 
        return open(file, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dd1fa66d957f93c2 — Filesystem access.
repo/src/click/_compat.py:371 
    return open(file, mode, encoding=encoding, errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a8273502b521827e — Environment-variable access.
repo/src/click/_termui_impl.py:418 
    pager_cmd_parts = shlex.split(os.environ.get("PAGER", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b613531c75743a3f — Environment-variable access.
repo/src/click/_termui_impl.py:424 
    if os.environ.get("TERM") in ("dumb", "emacs"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #627b6bcfb5ac77f7 — Environment-variable access.
repo/src/click/_termui_impl.py:516 
    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3347069a6af1eb7c — Environment-variable access.
repo/src/click/_termui_impl.py:521 
        less_flags = f"{os.environ.get('LESS', '')}{' '.join(cmd_params)}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e204d8abb523fc12 — Environment-variable access.
repo/src/click/_termui_impl.py:673 
            rv = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a36ddafee40a011 — Environment-variable access.
repo/src/click/_termui_impl.py:695 
            environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4914b161f2776306 — Filesystem access.
repo/src/click/_termui_impl.py:761 
            with open(name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fdcef8213fb57f14 — Filesystem access.
repo/src/click/_termui_impl.py:790 
        null = open("/dev/null", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #31c297f9244f6c4c — Filesystem access.
repo/src/click/_termui_impl.py:916 
            f = open("/dev/tty")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #581fabcfd34d1380 — Filesystem access.
repo/src/click/core.py:1286 
                formatter.write_text(text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93c649b8174b8d02 — Filesystem access.
repo/src/click/core.py:1319 
                formatter.write_text(epilog)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36df4b471f7358f7 — Environment-variable access.
repo/src/click/core.py:1612 
        instruction = os.environ.get(complete_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bbf3533b95fd6626 — Environment-variable access.
repo/src/click/core.py:2691 
            rv = os.environ.get(self.envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a8953d98b3b1047 — Environment-variable access.
repo/src/click/core.py:2697 
                rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d03fa525d3f0f443 — Environment-variable access.
repo/src/click/core.py:3527 
            rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6c8af0811870fa45 — Environment-variable access.
repo/src/click/shell_completion.py:433 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10065eb95d4574e0 — Environment-variable access.
repo/src/click/shell_completion.py:434 
        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1f1d4c825e9f1bc7 — Environment-variable access.
repo/src/click/shell_completion.py:455 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #22189a1fdf4fbfe6 — Environment-variable access.
repo/src/click/shell_completion.py:456 
        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4cf89ce34e3ce3a — Environment-variable access.
repo/src/click/shell_completion.py:491 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #18c3093858fc5b63 — Environment-variable access.
repo/src/click/shell_completion.py:492 
        incomplete = os.environ["COMP_CWORD"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df3f2ad48741de55 — Environment-variable access.
repo/src/click/shell_completion.py:531 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d0ba7e7ff919c474 — Environment-variable access.
repo/src/click/shell_completion.py:532 
        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f5204f2cefc0f29 — Environment-variable access.
repo/src/click/testing.py:567 
                old_env[key] = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #244205a0856bcf41 — Environment-variable access.
repo/src/click/testing.py:570 
                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e984e660d8f3efdc — Environment-variable access.
repo/src/click/testing.py:574 
                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0df1f834e666117c — Environment-variable access.
repo/src/click/testing.py:580 
                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a799e418955c8e2 — Environment-variable access.
repo/src/click/testing.py:584 
                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2bbd9b6ca428bfde — Filesystem access.
repo/src/click/utils.py:148 
                open(filename, mode).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f575337f635ffe48 — Environment-variable access.
repo/src/click/utils.py:499 
        folder = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a99cb719c5eb2ae — Environment-variable access.
repo/src/click/utils.py:510 
        os.environ.get("XDG_CONFIG_HOME", os.path.expanduser("~/.config")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (python): examples/aliases

python first-party
expand_more 1 low-confidence finding(s)
low env_fs test-only #fa29a179deeafcd1 — Filesystem access.
repo/examples/aliases/aliases.py:30 
        with open(filename, "wb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (python): examples/completion

python first-party
expand_more 2 low-confidence finding(s)
low env_fs test-only #a0ab7abb39c75bc0 — Environment-variable access.
repo/examples/completion/completion.py:21 
    return [k for k in os.environ if incomplete in k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only #5b2f693d26b94ee6 — Environment-variable access.
repo/examples/completion/completion.py:28 
    click.echo(f"Value: {os.environ[envvar]}")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

click

python dependency
expand_more 31 low-confidence finding(s)
low env_fs dependency Excluded from app score #514f244180ec8d93 — Filesystem access.
pkgs/python/[email protected]/src/click/_compat.py:366 
        return open(file, mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b36219e39fcc968 — Filesystem access.
pkgs/python/[email protected]/src/click/_compat.py:368 
    return open(file, mode, encoding=encoding, errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9cc494b4d3e40f26 — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:418 
    pager_cmd_parts = shlex.split(os.environ.get("PAGER", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #530be9e74955f26c — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:424 
    if os.environ.get("TERM") in ("dumb", "emacs"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #17db59c2b6c10300 — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:516 
    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49ffa0bb0d847114 — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:521 
        less_flags = f"{os.environ.get('LESS', '')}{' '.join(cmd_params)}"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a61944c4f1d6588c — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:673 
            rv = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be9ac353500e074f — Environment-variable access.
pkgs/python/[email protected]/src/click/_termui_impl.py:695 
            environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7eb13a7d069d6fe — Filesystem access.
pkgs/python/[email protected]/src/click/_termui_impl.py:761 
            with open(name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e0e722430337393 — Filesystem access.
pkgs/python/[email protected]/src/click/_termui_impl.py:790 
        null = open("/dev/null", "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba63d8d6bf43ffc4 — Filesystem access.
pkgs/python/[email protected]/src/click/_termui_impl.py:916 
            f = open("/dev/tty")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f44ebb5908fb086 — Filesystem access.
pkgs/python/[email protected]/src/click/core.py:1243 
                formatter.write_text(text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0659df6f712b172 — Filesystem access.
pkgs/python/[email protected]/src/click/core.py:1264 
                formatter.write_text(epilog)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd9325870b2b7328 — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:1557 
        instruction = os.environ.get(complete_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac6dedc085f7bbb1 — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:2631 
            rv = os.environ.get(self.envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff69a22db012becd — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:2637 
                rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7514da127c2ddba — Environment-variable access.
pkgs/python/[email protected]/src/click/core.py:3402 
            rv = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d3c51714e512113 — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:371 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #901c3a822835d45d — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:372 
        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50ca33afc8e8d7bd — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:393 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be53606c4902024c — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:394 
        cword = int(os.environ["COMP_CWORD"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af196759e876da84 — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:429 
        cwords = split_arg_string(os.environ["COMP_WORDS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d6ba1ad346a9784 — Environment-variable access.
pkgs/python/[email protected]/src/click/shell_completion.py:430 
        incomplete = os.environ["COMP_CWORD"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5284da3d537aa269 — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:567 
                old_env[key] = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2eeba8e8c31916b — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:570 
                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ea9146c9029451d1 — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:574 
                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #121da733150f83f5 — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:580 
                        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c01e1748df458df2 — Environment-variable access.
pkgs/python/[email protected]/src/click/testing.py:584 
                    os.environ[key] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d4e5665732869da — Filesystem access.
pkgs/python/[email protected]/src/click/utils.py:149 
                open(filename, mode).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd3f41c062a75ceb — Environment-variable access.
pkgs/python/[email protected]/src/click/utils.py:506 
        folder = os.environ.get(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45a0001b1c8c647f — Environment-variable access.
pkgs/python/[email protected]/src/click/utils.py:517 
        os.environ.get("XDG_CONFIG_HOME", os.path.expanduser("~/.config")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • pillow prod — sdist exceeds byte cap