Close Open Privacy Scan

bolt Snapshot: commit 2f16530

science engine v1.21

schedule 2026-07-19T11:15:22.614216+00:00

smart_toy AI deps detected: anthropic, llama-index, openai, qdrant-client — detected in dependencies, not a safety judgment.

App Privacy Score

22 /100

High privacy risk — possible application leak

High risk · 3997 finding(s)

Dependency score: 0 (High risk)

bar_chart Score Breakdown

pii_flow −60

egress −15

env_fs −3

list Scan Summary

0 high 66 medium 3931 low

First-party packages: 1

Dependency packages: 60

Ecosystem: python

swap_horiz Potential data exfiltration in application code

External domains: %s0001:002:003:0004::11.2.3.4::ffff:192.168.0.1acme.comaggregate.ee.engr.uky.eduai.google.devai.mongodb.comaiplatform.eu.rep.googleapis.comaiplatform.googleapis.comaiplatform.us.rep.googleapis.comandroid.stackexchange.comanimations.devapi.anthropic.comapi.cohere.comapi.github.comapi.jina.aiapi.nuget.orgapi.openai.comapi.reference.langfuse.comapi.siliconflow.cnapi.upstage.aiapi.voyageai.comarchive.orgarrow.apache.orgarstechnica.comarxiv.orgauth.openai.comaws.amazon.combayes.cs.ucla.edubetterexplained.combitbucket.orgbl.ocks.orgblog.alifaraji.irblog.cryptographyengineering.comblog.famzah.netblog.ganssle.ioblogs.ams.orgblogs.msdn.comblogs.msdn.microsoft.combooks.google.combootlin.combost.ocks.orgboto3.amazonaws.combpa.stbrew.shbrotlipy.readthedocs.iobugreports.qt.iobugs.launchpad.netbugs.python.orgbugs.winehq.orgbugzilla.gnome.orgbun.shcairosvg.orgcarto.comcdn-datasets.huggingface.cocdn.jsdelivr.netcdn.mathjax.orgcdnjs.cloudflare.comcens.ioc.eechevrotain.iochimera.labs.oreilly.comchromium.googlesource.comciteseer.ist.psu.educiteseerx.ist.psu.educlaude.googleapis.comcloud.google.comcloud.langfuse.comcode.activestate.comcole-maclean.github.iocollaboration.cmc.ec.gc.cacommonmark.orgconemu.github.ioconsole.cloud.google.comcookbook.openai.comcourses.cs.ut.eecr.yp.tocran.r-project.orgcran.rstudio.comcrates.iocrypto.cs.mcgill.cacsrc.nist.govcve.mitre.orgd3js.orgdash.voyageai.comdashscope.aliyuncs.comdata-apis.orgdatatracker.ietf.orgdbpubs.stanford.edudemotiles.maplibre.orgdeveloper.android.comdeveloper.apple.comdeveloper.mozilla.orgdevelopers.google.comdevguide.python.orgdigitalassets.lib.berkeley.edudiscuss.python.orgdl.acm.orgdl.google.comdmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdochub.mongodb.orgdocs.aiohttp.orgdocs.anthropic.comdocs.atlas.mongodb.comdocs.aws.amazon.comdocs.bodo.aidocs.cloud.google.comdocs.h5py.orgdocs.microsoft.comdocs.npmjs.comdocs.parallel.aidocs.pydantic.devdocs.pytest.orgdocs.python.orgdocs.pytorch.orgdocs.rsdocs.scipy.orgdocs.sqlalchemy.orgdocs.voyageai.comdoi.acm.orgdoi.orgdx.doi.orgeccc.hpi-web.deeclectic.ss.uci.edueli.thegreenplace.neten.wikipedia.orgen.wikiversity.orgeprint.iacr.orgepubs.siam.orgerrors.pydantic.devewbi.blogs.comexam_ple.comexample-resource.azure.openai.comexample-resource.services.ai.azure.comexcalidraw.comexslt.orgfakerjs.devfastapi.tiangolo.comflak.tedunangst.comfonts.googleapis.comfoo.comfoss.heptapod.netfreedesktop.orgfridrich.blogspot.nlgcc.gnu.orggenerativelanguage.googleapis.comgeoip.maps.opensearch.orggephi.orggexf.netgit.kernel.orggithub.comgitlab.comgitlab.freedesktop.orggo.devgoo.glgoogle.aip.devgoogle.comgoogle.github.iographics.stanford.edugraphml.graphdrawing.orggroups.google.comhal.archives-ouvertes.frhaproxy.1wt.euhdl.handle.nethelp.openai.comhf.cohg.python.orghomepages.dcc.ufmg.brhost.comhrcak.srce.hrhtml.spec.whatwg.orghttpbin.orghttpd.apache.orghuggingface.cohypothesis.readthedocs.ioicons.getbootstrap.comieeexplore.ieee.orgimageio.readthedocs.iointegrate.api.nvidia.comiopscience.iop.orgipython.orgipython.readthedocs.ioiuuk.mff.cuni.czj3-fortran.orgjmlr.csail.mit.edujournals.aps.orgjournals.plos.orgjponnela.comjson-schema.orgjsonlines.orglangfuse.comlanguage.googleapis.comlearn.microsoft.comlegacy.reactjs.orglibsdl.orglink.aps.orglink.springer.comlinuxdevcenter.comlists.sourceforge.netlocalhost.tiangolo.commagicstack.github.iomail.python.orgmanagement.azure.commanual.cytoscape.orgmath.berkeley.edumath.mit.edumath.stackexchange.commath.wvu.edumathworld.wolfram.commatomo.ouestware.commatplotlib.orgmedialab.sciencespo.frmembers.loria.frmerlinux.eumesonbuild.commetacpan.orgmicrosoft.github.iomineru.netmodel-spec.openai.commodelcontextprotocol.iomongodb.commsdn.microsoft.commy-server.commypy.readthedocs.iomüller.denats.ioneo4j.comnetworkx.lanl.govnetworkx.orgnicolas.limare.netnodatime.orgns.adobe.comnumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnumpydoc.readthedocs.ionvlpubs.nist.govoeis.orgoffice.microsoft.comofficeopenxml.comollama.comonlinelibrary.wiley.comonnxruntime.aiopen.bigmodel.cnopenai.comopenaipublic.blob.core.windows.netopenid.netopenproceedings.orgopenpyxl.readthedocs.ioopensearch.orgopensource.adobe.comopentelemetry.iooss.redis.comother.comouestware.compackages.msys2.orgpackaging.python.orgpandas.pydata.orgparquet.apache.orgpeople.csail.mit.edupeople.eecs.berkeley.edupeps.python.orgpersonal.math.ubc.capillow.readthedocs.iopip.pypa.ioplatform.claude.complatform.openai.compluggy.readthedocs.iopoint-at-infinity.orgportal.acm.orgportswigger.netpre-commit.compresbrey.mit.edupub.ist.ac.atpublic-sans.digital.govpurl.orgpy.readthedocs.iopybites.blogspot.bepydantic-docs.helpmanual.iopygraphviz.github.iopyinstaller.readthedocs.iopyjwt.readthedocs.iopypdf.readthedocs.iopyperclip.readthedocs.iopypi.orgpypi.python.orgpypinyin.readthedocs.iopython-devtools.helpmanual.iopython.langchain.compython.orgpythonhosted.orgpythontesting.netpyyaml.orgraw.githubusercontent.comreact.devreact.i18next.comreactjs.orgredis.comredis.ioredis.readthedocs.ioredisearch.iorefspecs.linuxfoundation.orgrich.readthedocs.iorosettacode.orgrussellfunk.orgs3.amazonaws.comsariyuce.comschemas.microsoft.comschemas.openxmlformatsschemas.openxmlformats.orgscikit-image.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgscipy.orgserverfault.comsethmlarson.devsetuptools.pypa.iosh.rustup.rssites.cs.ucsb.edusonner.emilkowal.skisourceforge.netsourceware.orgspdx.devspeakeasy.comspec.openapis.orgspecifications.freedesktop.orgspecs.frictionlessdata.iostackoverflow.comstartbigthinksmall.wordpress.comstorage.googleapis.comstudycli.orgsupport.sas.comswagger.iotechnet.microsoft.comtest.pypi.orgthemeui.nettikz.devtimeapi.iotools.ietf.orgtowardsdatascience.comtox.wikitruststore.readthedocs.iotwitter.comtyper.tiangolo.comtyping-extensions.readthedocs.iotyping.python.orgunpkg.comupload.wikimedia.orgurllib3.readthedocs.iousers.cecs.anu.edu.auvalidate-pyproject.readthedocs.iovideolectures.netviews.scientific-python.orgvirtualenv.pypa.iovis.socialvisualstudio.microsoft.comvlado.fmf.uni-lj.sivowpalwabbit.orgw.wikiw3.orgweb.archive.orgweb.cs.ucdavis.eduweb.eecs.utk.eduweb.math.princeton.eduweb.mit.eduwebsockets.readthedocs.iowiki.centos.orgwin.rustup.rswixtoolset.orgwrapdb.mesonbuild.comwuecampus2.uni-wuerzburg.dewww-cs-faculty.stanford.eduwww-cs-students.stanford.eduwww-personal.umich.eduwww.aiim.orgwww.algorithmic-solutions.infowww.ams.orgwww.analytictech.comwww.apache.orgwww.combinatorics.orgwww.coolmath.comwww.cs.cornell.eduwww.cs.purdue.eduwww.cs.technion.ac.ilwww.cs.ucdavis.eduwww.cs.umd.eduwww.cs.uu.nlwww.cse.msu.eduwww.ecma-international.orgwww.example.珠宝www.faqs.orgwww.fim.uni-passau.dewww.freedesktop.orgwww.gevent.orgwww.gexf.netwww.github.comwww.google.comwww.googleapis.comwww.graphdegeneracy.orgwww.graphviz.orgwww.haproxy.orgwww.hwjyw.comwww.iana.orgwww.ics.uci.eduwww.ietf.orgwww.informatik.uni-augsburg.dewww.intel.comwww.jmlr.orgwww.json.orgwww.jstor.orgwww.math.hmc.eduwww.math.uchicago.eduwww.math.ucsd.eduwww.mathjax.orgwww.mathworks.comwww.mdpi.comwww.microsoft.comwww.moe.edu.cnwww.mongodb.comwww.numberanalytics.comwww.oasis-open.orgwww.openblas.netwww.openssh.comwww.openssl.orgwww.openstreetmap.orgwww.opm.govwww.owasp.orgwww.pcre.orgwww.pinyin.infowww.pnas.orgwww.postgresql.orgwww.pycryptodome.orgwww.python.orgwww.researchgate.netwww.rfc-editor.orgwww.santafe.eduwww.santofortunato.netwww.scielo.brwww.sciencedirect.comwww.scipy.orgwww.secg.orgwww.sigmajs.orgwww.starlette.devwww.stata.comwww.stats.ox.ac.ukwww.statsmodels.orgwww.stixfonts.orgwww.sympy.orgwww.systutorials.comwww.tarsnap.comwww.usenix.orgwww.w3.orgwww.w3schools.comwww.win.tue.nlwww.xudongz.comwww.xyz.eduwww.youtube.comwww.yworks.comwww.zhihu.comwww2.asanet.orgxarray.pydata.orgxlrd.readthedocs.ioxn--fiqs8s.icom.museumyahoo.comyarnpkg.comyour-resource.openai.azure.comyourhost.comyoutu.bezh.wiktionary.org

medium lightrag-hku PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → pkgs/python/[email protected]/lightrag/tools/download_cache.py:43

medium lightrag-hku PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → pkgs/python/[email protected]/lightrag/tools/download_cache.py:105

medium lightrag-hku PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → pkgs/python/[email protected]/lightrag/tools/download_cache.py:108

medium lightrag-hku PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → pkgs/python/[email protected]/lightrag/tools/download_cache.py:116

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/evaluation/eval_rag_quality.py:320 → repo/lightrag/evaluation/eval_rag_quality.py:340

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/evaluation/eval_rag_quality.py:320 → repo/lightrag/evaluation/eval_rag_quality.py:343

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/llm/jina.py:128 → repo/lightrag/llm/jina.py:177

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/llm/voyageai.py:98 → repo/lightrag/llm/voyageai.py:147

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:132 → repo/lightrag/tools/download_cache.py:135

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:132 → repo/lightrag/tools/download_cache.py:197

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:132 → repo/lightrag/tools/download_cache.py:200

medium first-party (python) PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:132 → repo/lightrag/tools/download_cache.py:208

hub Dependency data flows (4)

medium lightrag-hku dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:320 → pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:340

medium lightrag-hku dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:320 → pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:343

medium lightrag-hku dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/llm/jina.py:128 → pkgs/python/[email protected]/lightrag/llm/jina.py:177

medium lightrag-hku dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/llm/voyageai.py:98 → pkgs/python/[email protected]/lightrag/llm/voyageai.py:147

</> First-Party Code

first-party (python)

python first-party

medium pii_flow production #47862b4592fbb168 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/evaluation/eval_rag_quality.py:340 · flow /tmp/closeopen-0bd58div/repo/lightrag/evaluation/eval_rag_quality.py:320 → /tmp/closeopen-0bd58div/repo/lightrag/evaluation/eval_rag_quality.py:340

            logger.debug("🔍 References Count: %s", len(references))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #0a27541ee29b58c2 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/evaluation/eval_rag_quality.py:343 · flow /tmp/closeopen-0bd58div/repo/lightrag/evaluation/eval_rag_quality.py:320 → /tmp/closeopen-0bd58div/repo/lightrag/evaluation/eval_rag_quality.py:343

                logger.debug("🔍 First Reference Keys: %s", list(first_ref.keys()))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #89435b1e8793770f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/llm/jina.py:177 · flow /tmp/closeopen-0bd58div/repo/lightrag/llm/jina.py:128 → /tmp/closeopen-0bd58div/repo/lightrag/llm/jina.py:177

        logger.debug(f"Jina embeddings generated: shape {embeddings.shape}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #42db1b651d1f0a04 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/llm/voyageai.py:147 · flow /tmp/closeopen-0bd58div/repo/lightrag/llm/voyageai.py:98 → /tmp/closeopen-0bd58div/repo/lightrag/llm/voyageai.py:147

        logger.debug(f"VoyageAI embeddings generated: shape {embeddings.shape}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #804e75aa36bc6ef8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:135 · flow /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:132 → /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:135

            print(f"Using TIKTOKEN_CACHE_DIR from environment: {cache_dir}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #b015949b2da06bb9 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:197 · flow /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:132 → /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:197

    print(f"\nCache location: {cache_dir}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #e2ad90b856823d48 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:200 · flow /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:132 → /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:200

    print(f"     tar -czf tiktoken_cache.tar.gz {cache_dir}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow production #91f432700fe73551 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

repo/lightrag/tools/download_cache.py:208 · flow /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:132 → /tmp/closeopen-0bd58div/repo/lightrag/tools/download_cache.py:208

    print(f"     cp -r {cache_dir} ~/.tiktoken_cache/")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 655 low-confidence finding(s)

low env_fs test-only Excluded from app score #1df53fa932d6d42a — Filesystem access.

repo/examples/generate_query.py:54

    with open(file_path, "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #da4660184832a8b8 — Filesystem access.

repo/examples/graph_visual_with_neo4j.py:85

        with open(output_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress test-only Excluded from app score #eccb0ce26ec3f793 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/examples/graph_visual_with_opensearch.py:53

    resp = requests.get(url, params=params, timeout=30)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress test-only Excluded from app score #875bb131215d76a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/examples/graph_visual_with_opensearch.py:147

        requests.get(f"{args.server}/health", timeout=5)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs test-only Excluded from app score #3e531764cf40863c — Environment-variable access.

repo/examples/lightrag_ag2_multiagent_demo.py:115

            "model": os.environ.get("OPENAI_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #35e81cf6f2317b37 — Environment-variable access.

repo/examples/lightrag_ag2_multiagent_demo.py:116

            "api_key": os.environ["OPENAI_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #de6a3a3c9cef2e05 — Environment-variable access.

repo/examples/lightrag_ag2_multiagent_demo.py:231

                "model": os.environ.get("OPENAI_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #e4600dc74d892d7c — Environment-variable access.

repo/examples/lightrag_ag2_multiagent_demo.py:232

                "api_key": os.environ["OPENAI_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #265c900331d4be71 — Environment-variable access.

repo/examples/lightrag_ag2_multiagent_demo.py:250

    if not os.getenv("OPENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #0de2be6e916f8adf — Environment-variable access.

repo/examples/lightrag_azure_openai_demo.py:14

AZURE_OPENAI_API_VERSION = os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #55c16327b57341a9 — Environment-variable access.

repo/examples/lightrag_azure_openai_demo.py:15

AZURE_OPENAI_DEPLOYMENT = os.getenv("AZURE_OPENAI_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #12137fb75d8e3d62 — Environment-variable access.

repo/examples/lightrag_azure_openai_demo.py:16

AZURE_OPENAI_API_KEY = os.getenv("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #adb6c3fe4ef20795 — Environment-variable access.

repo/examples/lightrag_azure_openai_demo.py:17

AZURE_OPENAI_ENDPOINT = os.getenv("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #14f18d0b25d0ac0d — Environment-variable access.

repo/examples/lightrag_azure_openai_demo.py:19

AZURE_EMBEDDING_DEPLOYMENT = os.getenv("AZURE_EMBEDDING_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #30d6b7c37ab68693 — Environment-variable access.

repo/examples/lightrag_azure_openai_demo.py:20

AZURE_EMBEDDING_API_VERSION = os.getenv("AZURE_EMBEDDING_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #97c6cc51e991db45 — Filesystem access.

repo/examples/lightrag_azure_openai_demo.py:104

    book1 = open("./book_1.txt", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #1fb92a11e2788833 — Filesystem access.

repo/examples/lightrag_azure_openai_demo.py:105

    book2 = open("./book_2.txt", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #7f1678a8f20e0328 — Environment-variable access.

repo/examples/lightrag_gemini_demo.py:33

GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #0c1bb20aeec8a7f8 — Filesystem access.

repo/examples/lightrag_gemini_demo.py:103

    with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #60863f687e791ce9 — Environment-variable access.

repo/examples/lightrag_gemini_postgres_demo.py:60

GEMINI_API_KEY = os.getenv("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #7c9d3461a8d057da — Filesystem access.

repo/examples/lightrag_gemini_postgres_demo.py:144

        with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #93e2e149fabb8dab — Environment-variable access.

repo/examples/lightrag_gemini_workspace_demo.py:41

        api_key=os.getenv("GEMINI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #849f662109b34f1b — Environment-variable access.

repo/examples/lightrag_gemini_workspace_demo.py:53

        texts, api_key=os.getenv("GEMINI_API_KEY"), model="models/text-embedding-004"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #699b191d186f9deb — Filesystem access.

repo/examples/lightrag_gemini_workspace_demo.py:95

            with open(book_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #d88a8b5dedefd9de — Filesystem access.

repo/examples/lightrag_gemini_workspace_demo.py:102

            with open(hr_path, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #12c701d510cfc612 — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:28

    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #89aa081c417ebe44 — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:35

    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #7a0aafe03503fd8c — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:36

    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #34e4fb22c5eb0ad3 — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:78

    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #9b47c0f59eb634a2 — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:89

        llm_model_name=os.getenv("LLM_MODEL", "qwen2.5-coder:7b"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #732a94e2cc320aff — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:92

            "host": os.getenv("LLM_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #dc4c599a2229d281 — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:94

            "timeout": int(os.getenv("TIMEOUT", "300")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #73bc59fedf34602d — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:101

            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #63c2cc005b975696 — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:102

            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "8192")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ef870812bbb638fa — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:105

                embed_model=os.getenv("EMBEDDING_MODEL", "bge-m3:latest"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ee38de34c31de888 — Environment-variable access.

repo/examples/lightrag_ollama_demo.py:106

                host=os.getenv("EMBEDDING_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #e1682d41720191e6 — Filesystem access.

repo/examples/lightrag_ollama_demo.py:152

        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a2f463e730893b95 — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:29

    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #d377864d19b66072 — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:38

    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6a5ab734b0c32faa — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:39

    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #bb17bcba8e8b7269 — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:81

    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ef0985bb9e6d4146 — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:92

        os.getenv("LLM_MODEL", "deepseek-chat"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #db995127819bc093 — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:96

        api_key=os.getenv("LLM_BINDING_API_KEY") or os.getenv("OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #9e6ae3fc5bc0ff5a — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:97

        base_url=os.getenv("LLM_BINDING_HOST", "https://api.deepseek.com"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #cb9448b21c9214ab — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:117

            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6953896ad44b2b25 — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:118

            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "8192")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #353fcdaa8d1e378a — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:121

                embed_model=os.getenv("EMBEDDING_MODEL", "bge-m3:latest"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #74fc1800956de98a — Environment-variable access.

repo/examples/lightrag_openai_compatible_demo.py:122

                host=os.getenv("EMBEDDING_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #63b6c38f9f78b3bf — Filesystem access.

repo/examples/lightrag_openai_compatible_demo.py:163

        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #7c17d225dbddfea5 — Environment-variable access.

repo/examples/lightrag_openai_demo.py:22

    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #c8e5cc8cf31ca5ae — Environment-variable access.

repo/examples/lightrag_openai_demo.py:29

    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #30c8c916c0288d0b — Environment-variable access.

repo/examples/lightrag_openai_demo.py:30

    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #f53031b0a668be43 — Environment-variable access.

repo/examples/lightrag_openai_demo.py:72

    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ebdf71d15167ce2c — Environment-variable access.

repo/examples/lightrag_openai_demo.py:93

    if not os.getenv("OPENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #8e65ed6984cbc97d — Filesystem access.

repo/examples/lightrag_openai_demo.py:132

        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #dd6b7e6a2efb437e — Environment-variable access.

repo/examples/lightrag_openai_mongodb_graph_demo.py:18

os.environ["OPENAI_API_KEY"] = "sk-"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6f7e0f262c206694 — Environment-variable access.

repo/examples/lightrag_openai_mongodb_graph_demo.py:19

os.environ["MONGO_URI"] = "mongodb://0.0.0.0:27017/?directConnection=true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #afd7caf3654fe66c — Environment-variable access.

repo/examples/lightrag_openai_mongodb_graph_demo.py:20

os.environ["MONGO_DATABASE"] = "LightRAG"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #538d09669ffe00f0 — Environment-variable access.

repo/examples/lightrag_openai_mongodb_graph_demo.py:21

os.environ["MONGO_KG_COLLECTION"] = "MDB_KG"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #1694d7368dd13ef4 — Environment-variable access.

repo/examples/lightrag_openai_mongodb_graph_demo.py:24

EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #1e303575771341e6 — Environment-variable access.

repo/examples/lightrag_openai_mongodb_graph_demo.py:25

EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #b7877256b67325ad — Filesystem access.

repo/examples/lightrag_openai_mongodb_graph_demo.py:75

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #adb9adce76f553b9 — Environment-variable access.

repo/examples/lightrag_openai_opensearch_graph_demo.py:56

if not os.getenv("OPENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ebbe33b8ccfe2e35 — Environment-variable access.

repo/examples/lightrag_openai_opensearch_graph_demo.py:57

    os.environ["OPENAI_API_KEY"] = "sk-"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6ef3b9e2a76ab252 — Environment-variable access.

repo/examples/lightrag_openai_opensearch_graph_demo.py:59

EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #4edfb45c3abd5959 — Environment-variable access.

repo/examples/lightrag_openai_opensearch_graph_demo.py:60

EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #30f7d5bd9170c33a — Filesystem access.

repo/examples/lightrag_openai_opensearch_graph_demo.py:144

        with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #e6dcb79b0f3c0694 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:60

        model=os.getenv("LLM_MODEL", "Qwen/Qwen3-14B-AWQ"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #12a3609e06aee4ab — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:64

        base_url=os.getenv("LLM_BINDING_HOST", "http://0.0.0.0:4646/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #40151c9705d9e216 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:65

        api_key=os.getenv("LLM_BINDING_API_KEY", "not_needed"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6051590f10c1acf5 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:76

    model_name=os.getenv("EMBEDDING_MODEL", "Qwen/Qwen3-Embedding-0.6B"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #101affa44a3331cd — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:78

    embedding_dim=int(os.getenv("EMBEDDING_DIM", 1024)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #03918ce9f982bd18 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:79

    max_token_size=int(os.getenv("EMBEDDING_TOKEN_LIMIT", 4096)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #d304406235518df2 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:82

        model=os.getenv("EMBEDDING_MODEL", "Qwen/Qwen3-Embedding-0.6B"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #df017548a763972b — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:83

        base_url=os.getenv(
            "EMBEDDING_BINDING_HOST",
            "http://0.0.0.0:1234/v1",
        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #17bf82ae9cd06de6 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:87

        api_key=os.getenv("EMBEDDING_BINDING_API_KEY", "not_needed"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #4a7f2a3726309951 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:97

    model=os.getenv("RERANK_MODEL", "Qwen/Qwen3-Reranker-0.6B"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #10b0557dba3f580b — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:98

    api_key=os.getenv("RERANK_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #5f20c10529f94645 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:99

    base_url=os.getenv(
        "RERANK_BINDING_HOST",
        "http://0.0.0.0:3535/v1/rerank",
    ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ad433b85fa69d51a — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:117

        kv_storage=os.getenv("KV_STORAGE", "PGKVStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #05d8660b298dcf16 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:118

        doc_status_storage=os.getenv("DOC_STATUS_STORAGE", "PGDocStatusStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #488baa03d33d8d5b — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:119

        vector_storage=os.getenv("VECTOR_STORAGE", "PGVectorStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #53ab7904dc6f4e82 — Environment-variable access.

repo/examples/lightrag_vllm_demo.py:120

        graph_storage=os.getenv("GRAPH_STORAGE", "Neo4JStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #b8abec579e64a5e5 — Filesystem access.

repo/examples/lightrag_vllm_demo.py:147

        with open(BOOK_FILE, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #121423f221bafdda — Environment-variable access.

repo/examples/milvus_kwargs_configuration_demo.py:20

    os.environ["MILVUS_URI"] = "http://localhost:19530"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #7d7483f096962798 — Environment-variable access.

repo/examples/rerank_example.py:51

        os.getenv("LLM_MODEL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #f47bcda5141f1751 — Environment-variable access.

repo/examples/rerank_example.py:55

        api_key=os.getenv("LLM_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ae64e23967453619 — Environment-variable access.

repo/examples/rerank_example.py:56

        base_url=os.getenv("LLM_BINDING_HOST"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #6822ecf8768e6ec5 — Environment-variable access.

repo/examples/rerank_example.py:64

        model=os.getenv("EMBEDDING_MODEL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #12359f49a08482dd — Environment-variable access.

repo/examples/rerank_example.py:65

        api_key=os.getenv("EMBEDDING_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #eb23978c572c3673 — Environment-variable access.

repo/examples/rerank_example.py:66

        base_url=os.getenv("EMBEDDING_BINDING_HOST"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #dd2d36365a323d5d — Environment-variable access.

repo/examples/rerank_example.py:72

    model=os.getenv("RERANK_MODEL", "rerank-v3.5"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #fd4448ea4f7c233c — Environment-variable access.

repo/examples/rerank_example.py:73

    api_key=os.getenv("RERANK_BINDING_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #422c0e6b95c7074d — Environment-variable access.

repo/examples/rerank_example.py:74

    base_url=os.getenv("RERANK_BINDING_HOST", "https://api.cohere.com/v2/rerank"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #3d8f41f82cf10c37 — Environment-variable access.

repo/examples/rerank_example.py:75

    enable_chunking=os.getenv("RERANK_ENABLE_CHUNKING", "false").lower() == "true",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #5d70c745066ef816 — Environment-variable access.

repo/examples/rerank_example.py:76

    max_tokens_per_doc=int(os.getenv("RERANK_MAX_TOKENS_PER_DOC", "4096")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow test-only Excluded from app score #da183b8fc2154e25 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

repo/examples/rerank_example.py:196 · flow /tmp/closeopen-0bd58div/repo/examples/rerank_example.py:73 → /tmp/closeopen-0bd58div/repo/examples/rerank_example.py:196

            print(f"  {index}. Score: {score:.4f} | {content}...")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs test-only Excluded from app score #b992460e2aeaed9c — Environment-variable access.

repo/examples/unofficial-sample/copy_llm_cache_to_another_storage.py:17

ROOT_DIR = os.environ.get("ROOT_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a72c55aea39041c7 — Environment-variable access.

repo/examples/unofficial-sample/copy_llm_cache_to_another_storage.py:26

os.environ["AGE_GRAPH_NAME"] = "chinese"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #fdaf097e9b531313 — Filesystem access.

repo/examples/unofficial-sample/lightrag_bedrock_demo.py:41

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress test-only Excluded from app score #07f8312b9e841cfd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:63

            response_raw = requests.post(
                f"{self.api_base_url}{model_name}", headers=headers, json=input_
            ).json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs test-only Excluded from app score #5a927cd2eff99207 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:141

    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #c98634135f423bd5 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:150

    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #0c2e79f220dbfd8a — Environment-variable access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:151

    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #3e197d2bd9a71f01 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:193

    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a883f465545931ca — Environment-variable access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:212

        llm_model_name=os.getenv("LLM_MODEL", LLM_MODEL),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #9727568bf37bebb9 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:215

            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #653dbd1201f4e8cc — Environment-variable access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:216

            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "2048")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #3b85c2d19a7c0ed8 — Filesystem access.

repo/examples/unofficial-sample/lightrag_cloudflare_demo.py:266

        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #0acead9ef4ab0a51 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:29

    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #52bc7dadaf199ae2 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:38

    log_max_bytes = int(os.getenv("LOG_MAX_BYTES", 10485760))  # Default 10MB

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #458698c92975ebac — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:39

    log_backup_count = int(os.getenv("LOG_BACKUP_COUNT", 5))  # Default 5 backups

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #466d5f28e4a48934 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:81

    set_verbose_debug(os.getenv("VERBOSE_DEBUG", "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #502093a3e4557d79 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:92

        os.getenv("LLM_MODEL", "deepseek-chat"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a7eef45104b13720 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:96

        api_key=os.getenv("LLM_BINDING_API_KEY") or os.getenv("OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ba2a7d06352aae2a — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:97

        base_url=os.getenv("LLM_BINDING_HOST", "https://api.deepseek.com"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #a2ed34151823a08e — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:117

            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #236427b20deb0aa8 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:118

            max_token_size=int(os.getenv("MAX_EMBED_TOKENS", "8192")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ec937f66fccab0d4 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:122

                embed_model=os.getenv("EMBEDDING_MODEL", "FRIDA:latest"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #9afa423d07c91c9f — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:123

                host=os.getenv("EMBEDDING_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #9f28a1f4ffe68f44 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:124

                query_prefix=os.getenv("EMBEDDING_QUERY_PREFIX", "search_query: "),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #aa11a19337d92b3e — Environment-variable access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:125

                document_prefix=os.getenv(
                    "EMBEDDING_DOCUMENT_PREFIX", "search_document: "
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #2b40721373bb6259 — Filesystem access.

repo/examples/unofficial-sample/lightrag_embedding_prefixes.py:169

        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #87421a95b46a6575 — Filesystem access.

repo/examples/unofficial-sample/lightrag_hf_demo.py:46

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #36509997790b0811 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:21

LLM_MODEL = os.environ.get("LLM_MODEL", "gpt-4")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ddcc435f46e0a9ed — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:23

EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #8cea0666006b765b — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:25

EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #2c436c11799d7ad7 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:29

OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "your-api-key-here")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #3c143d3e08d366fa — Filesystem access.

repo/examples/unofficial-sample/lightrag_llamaindex_direct_demo.py:105

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #4db3d9786c809f82 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:21

LLM_MODEL = os.environ.get("LLM_MODEL", "gpt-4")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #97fc51eea948951c — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:23

EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "text-embedding-3-large")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #55ff63bb77c8342d — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:25

EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #02a2af6d826cab5a — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:29

LITELLM_URL = os.environ.get("LITELLM_URL", "http://localhost:4000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #d4d72602f69c0d1e — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:31

LITELLM_KEY = os.environ.get("LITELLM_KEY", "sk-1234")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #28a999e8999d26b3 — Filesystem access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_demo.py:107

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #0e147161521923ba — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:21

LLM_MODEL = os.environ.get("LLM_MODEL", "gemma-3-4b")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #0083ac96264ab96a — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:23

EMBEDDING_MODEL = os.environ.get("EMBEDDING_MODEL", "arctic-embed")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #4442c8f108b1e3a5 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:25

EMBEDDING_MAX_TOKEN_SIZE = int(os.environ.get("EMBEDDING_MAX_TOKEN_SIZE", 8192))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #eeb3f5f45ced31cd — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:29

LITELLM_URL = os.environ.get("LITELLM_URL", "http://localhost:4000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #cf7e79b7910dec28 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:31

LITELLM_KEY = os.environ.get("LITELLM_KEY", "sk-4JdvGFKqSA3S0k_5p0xufw")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #093db4e7c15c0359 — Filesystem access.

repo/examples/unofficial-sample/lightrag_llamaindex_litellm_opik_demo.py:118

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #2f6ab4f105e45a67 — Filesystem access.

repo/examples/unofficial-sample/lightrag_lmdeploy_demo.py:73

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #ab342b938ce390e7 — Filesystem access.

repo/examples/unofficial-sample/lightrag_nvidia_demo.py:127

        with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #93ea60e5bcf11e27 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:15

os.environ["REDIS_URI"] = "redis://localhost:6379"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #3d61b67d89af9dab — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:20

os.environ["NEO4J_URI"] = "neo4j://localhost:7687"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #cecd1732e6a2c9f8 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:21

os.environ["NEO4J_USERNAME"] = "neo4j"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #3679c69c2efdf7e4 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:22

os.environ["NEO4J_PASSWORD"] = "12345678"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #785aa6c28bd4340c — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:25

os.environ["MILVUS_URI"] = "http://localhost:19530"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #0adc40860af9faf8 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:26

os.environ["MILVUS_USER"] = "root"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #83f7b7c6a20101f5 — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:27

os.environ["MILVUS_PASSWORD"] = "Milvus"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #b031fd3da9fe70fe — Environment-variable access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:28

os.environ["MILVUS_DB_NAME"] = "lightrag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #4caea7688c65c9b4 — Filesystem access.

repo/examples/unofficial-sample/lightrag_openai_neo4j_milvus_redis_demo.py:76

    with open("./book.txt", "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3cb68f10afbf1252 — Environment-variable access.

repo/lightrag/api/config.py:73

        "ollama": os.getenv("LLM_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #41ff8b94d731eb21 — Environment-variable access.

repo/lightrag/api/config.py:74

        "lollms": os.getenv("LLM_BINDING_HOST", "http://localhost:9600"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e126e870e59944e7 — Environment-variable access.

repo/lightrag/api/config.py:75

        "azure_openai": os.getenv("AZURE_OPENAI_ENDPOINT", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #766c8c3a03bcaf57 — Environment-variable access.

repo/lightrag/api/config.py:76

        "openai": os.getenv("LLM_BINDING_HOST", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #391146e76cad6271 — Environment-variable access.

repo/lightrag/api/config.py:79

        "bedrock": os.getenv("LLM_BINDING_HOST", "DEFAULT_BEDROCK_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2cfef91e5c7f28cb — Environment-variable access.

repo/lightrag/api/config.py:82

        "gemini": os.getenv("LLM_BINDING_HOST", "DEFAULT_GEMINI_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cb66d15d26ab9778 — Environment-variable access.

repo/lightrag/api/config.py:85

        binding_type, os.getenv("LLM_BINDING_HOST", "http://localhost:11434")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c5ccb136b246db6f — Environment-variable access.

repo/lightrag/api/config.py:143

    if env_key not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8766e8f91e0675dd — Environment-variable access.

repo/lightrag/api/config.py:146

    value = os.environ[env_key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3a200a8f515adadb — Environment-variable access.

repo/lightrag/api/config.py:176

    bearer_token = os.getenv("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b7ac02a844bf25c0 — Environment-variable access.

repo/lightrag/api/config.py:741

    args.embedding_asymmetric_configured = "EMBEDDING_ASYMMETRIC" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5daadd9e7753de96 — Environment-variable access.

repo/lightrag/api/gunicorn_config.py:14

log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f9b2891391a74591 — Environment-variable access.

repo/lightrag/api/gunicorn_config.py:40

errorlog = os.getenv("ERROR_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2d30c3c97e8a5e54 — Environment-variable access.

repo/lightrag/api/gunicorn_config.py:41

accesslog = os.getenv("ACCESS_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #400178070b07a712 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:88

webui_title = os.getenv("WEBUI_TITLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #535d27cf8ca9c4ca — Environment-variable access.

repo/lightrag/api/lightrag_server.py:89

webui_description = os.getenv("WEBUI_DESCRIPTION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6207d5c86892b4d8 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:497

    api_mode_raw = os.getenv("MINERU_API_MODE", "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #39c9c9735042fc6d — Environment-variable access.

repo/lightrag/api/lightrag_server.py:501

        endpoint = os.getenv("MINERU_OFFICIAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c150ae69fbd2c417 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:503

        endpoint = os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #748097a0d4b367da — Environment-variable access.

repo/lightrag/api/lightrag_server.py:530

    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8d00d0a5cd488dc4 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:538

            "ocr_engine": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c6c366c61142ab88 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:539

            "ocr_lang": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0d72bd8f90360344 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:1274

    api_key = os.getenv("LIGHTRAG_API_KEY") or args.key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8045bd85db9ce43c — Environment-variable access.

repo/lightrag/api/lightrag_server.py:1309

            if "LIGHTRAG_GUNICORN_MODE" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e53380bec65d2b70 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:1560

                api_key=os.getenv("AZURE_OPENAI_API_KEY", args.llm_binding_api_key),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bfc84eeea1a09349 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:1561

                api_version=os.getenv("AZURE_OPENAI_API_VERSION", "2024-08-01-preview"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #242c9d52fb3b919c — Environment-variable access.

repo/lightrag/api/lightrag_server.py:1875

                        api_key=role_apikey or os.getenv("AZURE_OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5fffe8fc05cae8ad — Environment-variable access.

repo/lightrag/api/lightrag_server.py:1876

                        api_version=os.getenv(
                            "AZURE_OPENAI_API_VERSION", "2024-08-01-preview"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e03271e4bab846ae — Environment-variable access.

repo/lightrag/api/lightrag_server.py:2036

                os.getenv("RERANK_ENABLE_CHUNKING", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0b56065891968caa — Environment-variable access.

repo/lightrag/api/lightrag_server.py:2038

            raw_max_tokens = os.getenv(
                "RERANK_MAX_TOKENS_PER_DOC", str(DEFAULT_RERANK_MAX_TOKENS_PER_DOC)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f3823ed18e39aa0c — Environment-variable access.

repo/lightrag/api/lightrag_server.py:2533

                    if os.environ.get("LIGHTRAG_GUNICORN_MODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #37a45662f0f81e28 — Filesystem access.

repo/lightrag/api/lightrag_server.py:2626

                content = Path(response.path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1c0f7af022821bb7 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:2696

    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3efea6cb5ef04a82 — Environment-variable access.

repo/lightrag/api/lightrag_server.py:2801

    if "GUNICORN_CMD_ARGS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #534117b002bccfcf — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:13

_PROCESS_START_OBJC_FORK_SAFETY = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8cb7b686998792c5 — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:76

    os.environ["LIGHTRAG_GUNICORN_MODE"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fae1b2f4f9f8daeb — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:88

        current_objc_fork_safety = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6a7bc4eb67a14a4e — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:206

                else os.getenv("HOST", "0.0.0.0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1df560e9626e186e — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:219

                else os.getenv("LOG_LEVEL", "info")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aa6fef4af1d38759 — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:235

            if global_args.ssl or os.getenv("SSL", "").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f40aefcef45561ae — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:245

                    else os.getenv("SSL_CERTFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fb04613b9e22faf4 — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:250

                    else os.getenv("SSL_KEYFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9d6c7da380efa973 — Environment-variable access.

repo/lightrag/api/run_with_gunicorn.py:284

        os.environ["LIGHTRAG_MAIN_PROCESS"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #20abb0f87f5771a2 — Filesystem access.

repo/lightrag/api/runtime_validation.py:36

            return Path(candidate).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6766cb061d4954cf — Environment-variable access.

repo/lightrag/api/runtime_validation.py:47

    environ = environ or os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cc1151b2034b6735 — Environment-variable access.

repo/lightrag/base.py:41

        self._lightrag_name = name or os.getenv(
            "OLLAMA_EMULATING_MODEL_NAME", DEFAULT_OLLAMA_MODEL_NAME
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ac7079e783db7bb7 — Environment-variable access.

repo/lightrag/base.py:44

        self._lightrag_tag = tag or os.getenv(
            "OLLAMA_EMULATING_MODEL_TAG", DEFAULT_OLLAMA_MODEL_TAG
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #55e1430bd03d4ab8 — Environment-variable access.

repo/lightrag/base.py:107

    top_k: int = int(os.getenv("TOP_K", str(DEFAULT_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a7c62b1f64c24c26 — Environment-variable access.

repo/lightrag/base.py:110

    chunk_top_k: int = int(os.getenv("CHUNK_TOP_K", str(DEFAULT_CHUNK_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f523d9d81209ff0c — Environment-variable access.

repo/lightrag/base.py:116

        os.getenv("MAX_ENTITY_TOKENS", str(DEFAULT_MAX_ENTITY_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ae382530c8848d7a — Environment-variable access.

repo/lightrag/base.py:121

        os.getenv("MAX_RELATION_TOKENS", str(DEFAULT_MAX_RELATION_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0533922f6ad8f465 — Environment-variable access.

repo/lightrag/base.py:126

        os.getenv("MAX_TOTAL_TOKENS", str(DEFAULT_MAX_TOTAL_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #dc25c175a495b81e — Environment-variable access.

repo/lightrag/base.py:148

    enable_rerank: bool = os.getenv("RERANK_BY_DEFAULT", "true").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #da9af90f68214c39 — Environment-variable access.

repo/lightrag/chunker/paragraph_semantic.py:217

    raw = os.getenv("CHUNK_P_REFERENCES_TAIL_N")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9e00409916a137fe — Environment-variable access.

repo/lightrag/chunker/paragraph_semantic.py:238

    raw = os.getenv("CHUNK_P_REFERENCES_HEADINGS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c03b590c87e96e07 — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:147

        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d00123db6f44ba12 — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:147

        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(
            "OPENAI_API_KEY"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b81fa0d75835565d — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:157

        eval_model = os.getenv("EVAL_LLM_MODEL", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #746e4411d7fa93e1 — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:158

        eval_llm_base_url = os.getenv("EVAL_LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #16046949590cec86 — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:163

            os.getenv("EVAL_EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #63f8004ae11f40ba — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:164

            or os.getenv("EVAL_LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1bb12adaf4b174e6 — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:165

            or os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2425b0264fa6b90c — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:167

        eval_embedding_model = os.getenv(
            "EVAL_EMBEDDING_MODEL", "text-embedding-3-large"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #357fd80278f250eb — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:171

        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a6be727e6d5eba1d — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:171

        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(
            "EVAL_LLM_BINDING_HOST"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a54a447659d10af0 — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:179

            "max_retries": int(os.getenv("EVAL_LLM_MAX_RETRIES", "5")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #38322bbcbdca3c4e — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:180

            "request_timeout": int(os.getenv("EVAL_LLM_TIMEOUT", "180")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #875aa803219ac6da — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:218

            rag_api_url = os.getenv("LIGHTRAG_API_URL", "http://localhost:9621")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9d86d4b81b508077 — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:269

        query_top_k = int(os.getenv("EVAL_QUERY_TOP_K", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #18f6d51e7980ec59 — Filesystem access.

repo/lightrag/evaluation/eval_rag_quality.py:285

        with open(self.test_dataset_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1ea074f6b2d1bf4b — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:316

                "top_k": int(os.getenv("EVAL_QUERY_TOP_K", "10")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a747a0a33cb931de — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:320

            api_key = os.getenv("LIGHTRAG_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #ee7affbbd7f3eda2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/evaluation/eval_rag_quality.py:328

            response = await client.post(
                f"{self.rag_api_url}/query",
                json=payload,
                headers=headers if headers else None,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #06b1167ec4b9f034 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/evaluation/eval_rag_quality.py:554

                        await position_pool.put(position)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #16edd6b1a930a9ae — Environment-variable access.

repo/lightrag/evaluation/eval_rag_quality.py:564

        max_async = int(os.getenv("EVAL_MAX_CONCURRENT", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #648447420a5e3156 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/evaluation/eval_rag_quality.py:584

            await position_pool.put(i)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #1632a5d7c10ee6d9 — Filesystem access.

repo/lightrag/evaluation/eval_rag_quality.py:647

        with open(csv_path, "w", newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #671e38003f9c0b43 — Filesystem access.

repo/lightrag/evaluation/eval_rag_quality.py:899

        with open(json_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #712cb604185f7575 — Filesystem access.

repo/lightrag/evaluation/offline_retrieval_check.py:84

    payload = json.loads(dataset_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9edd35374ec28d1b — Filesystem access.

repo/lightrag/evaluation/offline_retrieval_check.py:92

    payload = json.loads(oracle_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #52444aacd01fa304 — Filesystem access.

repo/lightrag/evaluation/offline_retrieval_check.py:115

                tokens=Counter(tokenize(path.read_text(encoding="utf-8"))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7b5ea748c787e33c — Filesystem access.

repo/lightrag/kg/faiss_impl.py:820

            with open(tmp, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3d50aee5d65a2c38 — Filesystem access.

repo/lightrag/kg/faiss_impl.py:853

            with open(self._meta_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #074d1e11a87059db — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:27

MAX_GRAPH_NODES = int(os.getenv("MAX_GRAPH_NODES", 1000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b4ee91013f481419 — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:38

        memgraph_workspace = os.environ.get("MEMGRAPH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f636501a963398ee — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:78

            URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #06012b1afe915bbe — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:78

            URI = os.environ.get(
                "MEMGRAPH_URI",
                config.get("memgraph", "uri", fallback="bolt://localhost:7687"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8f696039389afa85 — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:82

            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3bffac704504a4a3 — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:82

            USERNAME = os.environ.get(
                "MEMGRAPH_USERNAME", config.get("memgraph", "username", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fdbf03ac08647c25 — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:85

            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ff3a02266d0b8a54 — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:85

            PASSWORD = os.environ.get(
                "MEMGRAPH_PASSWORD", config.get("memgraph", "password", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c8bdd7f6669b0577 — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:88

            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0c80236410ef008a — Environment-variable access.

repo/lightrag/kg/memgraph_impl.py:88

            DATABASE = os.environ.get(
                "MEMGRAPH_DATABASE",
                config.get("memgraph", "database", fallback="memgraph"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fe09db089cbebc0f — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:159

    val = os.environ.get(key, "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1ce2ea4a3a79da77 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:169

    val = os.environ.get(key, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4cbf221fd3749c97 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:212

            self.index_type or os.environ.get("MILVUS_INDEX_TYPE", "AUTOINDEX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8563b06a6a85fa5d — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:217

            self.metric_type or os.environ.get("MILVUS_METRIC_TYPE", "COSINE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #146df0e717b14237 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:231

            self.sq_type = os.environ.get("MILVUS_HNSW_SQ_TYPE", "SQ8").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #74f47ebf8ad2eaa4 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:235

            self.sq_refine_type = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #76849ac4bfa3762d — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:235

            self.sq_refine_type = os.environ.get(
                "MILVUS_HNSW_SQ_REFINE_TYPE", "FP32"
            ).upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #90e5feb78a86bdda — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:442

            "uri": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2e03caaf26a963a4 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:442

            "uri": os.environ.get(
                "MILVUS_URI",
                config.get(
                    "milvus",
                    "uri",
                    fallback=os.path.join(
                        self.global_config["working_dir"], "milvus_lite.db"
                    ),
                ),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2dd3e346faa9b2a8 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:452

            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #05224903956c4258 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:452

            "user": os.environ.get(
                "MILVUS_USER", config.get("milvus", "user", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0c754b397775605d — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:455

            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ef0db84772f87926 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:455

            "password": os.environ.get(
                "MILVUS_PASSWORD",
                config.get("milvus", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4e6468c4622aee7e — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:459

            "token": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8c0a3ae6819f44ec — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:459

            "token": os.environ.get(
                "MILVUS_TOKEN", config.get("milvus", "token", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e7dbea102c652fe5 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:464

        db_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #824ec576be1aed6e — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:464

        db_name = os.environ.get(
            "MILVUS_DB_NAME",
            config.get("milvus", "db_name", fallback=None),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e027826fe115172b — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:2092

        milvus_workspace = os.environ.get("MILVUS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #97002269aec0ac3f — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:2144

            os.getenv(
                "MILVUS_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_MILVUS_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #79fec35d4e02fc01 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:2150

            os.getenv(
                "MILVUS_UPSERT_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_UPSERT_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0a4521df82ec9af7 — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:2156

            os.getenv(
                "MILVUS_DELETE_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_DELETE_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #acea5b121406f08b — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:2183

            os.getenv(
                "MILVUS_MIGRATION_RETRY_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b514f658aa7c6f3c — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:2189

            os.getenv(
                "MILVUS_MIGRATION_RETRY_MAX_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_MAX_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4be1ea88814f681e — Environment-variable access.

repo/lightrag/kg/milvus_impl.py:2211

                os.getenv(
                    "MILVUS_MIGRATION_BATCH_SLEEP",
                    str(DEFAULT_MILVUS_MIGRATION_BATCH_SLEEP_SECONDS),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #211b37c4248f7506 — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:52

GRAPH_BFS_MODE = os.getenv("MONGO_GRAPH_BFS_MODE", "bidirectional")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0a073822af67f458 — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:190

        os.getenv(
            "MONGO_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_MONGO_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #43ce4327da8c5d77 — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:196

        os.getenv(
            "MONGO_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6e01f035aca828fc — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:221

        os.getenv(
            "MONGO_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a5767e9c2923e6c4 — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:287

                uri = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8bba81e6413cc6ad — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:287

                uri = os.environ.get(
                    "MONGO_URI",
                    config.get(
                        "mongodb",
                        "uri",
                        fallback="mongodb://root:root@localhost:27017/",
                    ),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7634409d103337cb — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:295

                database_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3fced346f23e2b8b — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:295

                database_name = os.environ.get(
                    "MONGO_DATABASE",
                    config.get("mongodb", "database", fallback="LightRAG"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #91d5ea4616a9c12e — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:343

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a4a904f9dd00f78b — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:592

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d74ca003e5ea3c7d — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:1106

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #caf9a2721dae64be — Environment-variable access.

repo/lightrag/kg/mongo_impl.py:2886

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #7376b49a3c3dd00b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/kg/nano_vector_db_impl.py:539

                if self._client.get([entity_id]):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #c59972bd4a5eaa25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/kg/nano_vector_db_impl.py:726

        result = client.get([id])

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #99d5dd4e5c9e0c93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/kg/nano_vector_db_impl.py:757

            for dp in client.get(remaining):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #220bd1fe10405911 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/kg/nano_vector_db_impl.py:824

            for result in client.get(remaining):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #4995a5d24f93e6ca — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:81

        neo4j_workspace = os.environ.get("NEO4J_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #686ca70a13e5d470 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:174

            URI = os.environ.get("NEO4J_URI", config.get("neo4j", "uri", fallback=None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #36429a3a9b0385ce — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:175

            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8190854cb1f30730 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:175

            USERNAME = os.environ.get(
                "NEO4J_USERNAME", config.get("neo4j", "username", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6afe9f32d3069d48 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:178

            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a479d25bf6656124 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:178

            PASSWORD = os.environ.get(
                "NEO4J_PASSWORD", config.get("neo4j", "password", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #65bdf569751792ab — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:182

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a233cf928ff9b801 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:182

                os.environ.get(
                    "NEO4J_MAX_CONNECTION_POOL_SIZE",
                    config.get("neo4j", "connection_pool_size", fallback=100),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bc9978fabf2b76bf — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:188

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b74c10de1b80ea68 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:188

                os.environ.get(
                    "NEO4J_CONNECTION_TIMEOUT",
                    config.get("neo4j", "connection_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7aaa7fb4b1297141 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:194

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6d6871cc001a3208 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:194

                os.environ.get(
                    "NEO4J_CONNECTION_ACQUISITION_TIMEOUT",
                    config.get(
                        "neo4j", "connection_acquisition_timeout", fallback=30.0
                    ),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cacc9278f5f992c9 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:202

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e8c3a9309ed7d5bd — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:202

                os.environ.get(
                    "NEO4J_MAX_TRANSACTION_RETRY_TIME",
                    config.get("neo4j", "max_transaction_retry_time", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7a301c2248ab37ee — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:208

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0f4b0bc6f8d3db0d — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:208

                os.environ.get(
                    "NEO4J_MAX_CONNECTION_LIFETIME",
                    config.get("neo4j", "max_connection_lifetime", fallback=300.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #425ca9ffb5ad3fc4 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:214

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #824c44b07e0d164d — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:214

                os.environ.get(
                    "NEO4J_LIVENESS_CHECK_TIMEOUT",
                    config.get("neo4j", "liveness_check_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8108379c5d0f9557 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:219

            KEEP_ALIVE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8606e1d53fea36a2 — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:219

            KEEP_ALIVE = os.environ.get(
                "NEO4J_KEEP_ALIVE",
                config.get("neo4j", "keep_alive", fallback="true"),
            ).lower() in ("true", "1", "yes", "on")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #35a5630c3b8e687a — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:223

            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bff197e783d9694f — Environment-variable access.

repo/lightrag/kg/neo4j_impl.py:223

            DATABASE = os.environ.get(
                "NEO4J_DATABASE", re.sub(r"[^a-zA-Z0-9-]", "-", self.namespace)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d3a25fdae327a784 — Environment-variable access.

repo/lightrag/kg/opensearch_impl.py:60

    return os.environ.get(key, config.get("opensearch", cfg_key, fallback=fallback))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #006e2a36e798b82e — Environment-variable access.

repo/lightrag/kg/opensearch_impl.py:524

    opensearch_workspace = os.environ.get("OPENSEARCH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #dda58f3a71f6972f — Environment-variable access.

repo/lightrag/kg/opensearch_impl.py:1942

        env_override = os.environ.get("OPENSEARCH_USE_PPL_GRAPHLOOKUP", "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #11384eca0268728c — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:184

        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #248ecaac244b01bc — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:184

        os.environ.get(
            "POSTGRES_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_PG_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #544c0e77ca41bdb2 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:190

        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bdc49f8112bd241a — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:190

        os.environ.get(
            "POSTGRES_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4c43046f9a97039c — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:196

        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a03b218e11623a37 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:196

        os.environ.get(
            "POSTGRES_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2f0d8c67cb32931a — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2323

            "host": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7334c3992792e4dc — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2323

            "host": os.environ.get(
                "POSTGRES_HOST",
                config.get("postgres", "host", fallback="localhost"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a00b7e7e0df8e01f — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2327

            "port": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3eb344b31789f1d2 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2327

            "port": os.environ.get(
                "POSTGRES_PORT", config.get("postgres", "port", fallback=5432)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #79f186eb09936a77 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2330

            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8fa4b34e2c075be0 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2330

            "user": os.environ.get(
                "POSTGRES_USER", config.get("postgres", "user", fallback="postgres")
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #354ee7097dc20f4c — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2333

            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #53b33f8e22426e6e — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2333

            "password": os.environ.get(
                "POSTGRES_PASSWORD",
                config.get("postgres", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #257b7cebc44a9e43 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2337

            "database": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8c2519b6d12e1d46 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2337

            "database": os.environ.get(
                "POSTGRES_DATABASE",
                config.get("postgres", "database", fallback="postgres"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c8bd5367eeb33376 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2341

            "workspace": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b6f1375c60ba3f50 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2341

            "workspace": os.environ.get(
                "POSTGRES_WORKSPACE",
                config.get("postgres", "workspace", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3e5a06da37796364 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2345

            "max_connections": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2cc43203c487ad6c — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2345

            "max_connections": os.environ.get(
                "POSTGRES_MAX_CONNECTIONS",
                config.get("postgres", "max_connections", fallback=50),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #026f2aec5597d905 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2350

            "ssl_mode": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2eabe886cd2353e9 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2350

            "ssl_mode": os.environ.get(
                "POSTGRES_SSL_MODE",
                config.get("postgres", "ssl_mode", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #96a69e590591a394 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2354

            "ssl_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b33dfa2cd63ed218 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2354

            "ssl_cert": os.environ.get(
                "POSTGRES_SSL_CERT",
                config.get("postgres", "ssl_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2406d6c7011945f3 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2358

            "ssl_key": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ad1a86259083531c — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2358

            "ssl_key": os.environ.get(
                "POSTGRES_SSL_KEY",
                config.get("postgres", "ssl_key", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0169855b068f14de — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2362

            "ssl_root_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #90a267daf04595e5 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2362

            "ssl_root_cert": os.environ.get(
                "POSTGRES_SSL_ROOT_CERT",
                config.get("postgres", "ssl_root_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d7fde1b8f85accec — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2366

            "ssl_crl": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #124839b9f7506e2b — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2366

            "ssl_crl": os.environ.get(
                "POSTGRES_SSL_CRL",
                config.get("postgres", "ssl_crl", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f00b14cf94517759 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2375

            "vector_index_type": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #877c66703f9aaace — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2375

            "vector_index_type": os.environ.get(
                "POSTGRES_VECTOR_INDEX_TYPE",
                config.get("postgres", "vector_index_type", fallback="HNSW"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8a76f7c1b6815ecb — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2380

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #26513d93a77787e2 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2380

                os.environ.get(
                    "POSTGRES_HNSW_M",
                    config.get("postgres", "hnsw_m", fallback="16"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3cd7f2c35dce5867 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2386

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #df33801857b4313f — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2386

                os.environ.get(
                    "POSTGRES_HNSW_EF",
                    config.get("postgres", "hnsw_ef", fallback="64"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ead066b2d016f45b — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2392

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3436af05c5dd1611 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2392

                os.environ.get(
                    "POSTGRES_IVFFLAT_LISTS",
                    config.get("postgres", "ivfflat_lists", fallback="100"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c4892457fe0ac69a — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2397

            "vchordrq_build_options": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bb2ac60c495a857b — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2397

            "vchordrq_build_options": os.environ.get(
                "POSTGRES_VCHORDRQ_BUILD_OPTIONS",
                config.get("postgres", "vchordrq_build_options", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #251599dd0c393d92 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2401

            "vchordrq_probes": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #35c5958383594062 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2401

            "vchordrq_probes": os.environ.get(
                "POSTGRES_VCHORDRQ_PROBES",
                config.get("postgres", "vchordrq_probes", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8ad77679f26e3c23 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2406

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0d39e4a54fcb8036 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2406

                os.environ.get(
                    "POSTGRES_VCHORDRQ_EPSILON",
                    config.get("postgres", "vchordrq_epsilon", fallback="1.9"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3b8d6cdc3934506f — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2412

            "server_settings": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2055e74c05dbf01a — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2412

            "server_settings": os.environ.get(
                "POSTGRES_SERVER_SETTINGS",
                config.get("postgres", "server_options", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1a9ca1054726aa99 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2416

            "statement_cache_size": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8d82afd48842698d — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2416

            "statement_cache_size": os.environ.get(
                "POSTGRES_STATEMENT_CACHE_SIZE",
                config.get("postgres", "statement_cache_size", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c74b6d8b6e8a57e6 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2424

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ef485c00b420051c — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2424

                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRIES",
                        config.get("postgres", "connection_retries", fallback=10),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4797c7f845e92dcc — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2433

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #43e55b533991c043 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2433

                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF",
                        config.get(
                            "postgres", "connection_retry_backoff", fallback=3.0
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #20f3dbce39c37455 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2444

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6ef4aa30e88b48c7 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2444

                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF_MAX",
                        config.get(
                            "postgres",
                            "connection_retry_backoff_max",
                            fallback=30.0,
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #87387e0224699cfb — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2457

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1203e016389d7290 — Environment-variable access.

repo/lightrag/kg/postgres_impl.py:2457

                    os.environ.get(
                        "POSTGRES_POOL_CLOSE_TIMEOUT",
                        config.get("postgres", "pool_close_timeout", fallback=5.0),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #16b8874a76a1097c — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:482

        qdrant_workspace = os.environ.get("QDRANT_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #18075ea14cf180c2 — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:527

            os.getenv(
                "QDRANT_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_QDRANT_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0ee1a5dc60f5d144 — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:533

            os.getenv(
                "QDRANT_UPSERT_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_UPSERT_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #01a9b7439ea20178 — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:539

            os.getenv(
                "QDRANT_DELETE_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_DELETE_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #21380967a65a29ae — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:664

                        url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b359664bd532e603 — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:664

                        url=os.environ.get(
                            "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6a265713bcf635c0 — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:667

                        api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4e85dc7affbecc7a — Environment-variable access.

repo/lightrag/kg/qdrant_impl.py:667

                        api_key=os.environ.get(
                            "QDRANT_API_KEY",
                            config.get("qdrant", "apikey", fallback=None),
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #04c53b90e98f6ccd — Environment-variable access.

repo/lightrag/kg/redis_impl.py:46

MAX_CONNECTIONS = int(os.getenv("REDIS_MAX_CONNECTIONS", "200"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7a6bc675a28d461c — Environment-variable access.

repo/lightrag/kg/redis_impl.py:47

SOCKET_TIMEOUT = float(os.getenv("REDIS_SOCKET_TIMEOUT", "30.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #36b88e9a29521483 — Environment-variable access.

repo/lightrag/kg/redis_impl.py:48

SOCKET_CONNECT_TIMEOUT = float(os.getenv("REDIS_CONNECT_TIMEOUT", "10.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #595c39c956ac927d — Environment-variable access.

repo/lightrag/kg/redis_impl.py:49

RETRY_ATTEMPTS = int(os.getenv("REDIS_RETRY_ATTEMPTS", "3"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #79c3525e62b43c16 — Environment-variable access.

repo/lightrag/kg/redis_impl.py:200

        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #38f1d2ceeca1df69 — Environment-variable access.

repo/lightrag/kg/redis_impl.py:228

        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #091ea0cecace575f — Environment-variable access.

repo/lightrag/kg/redis_impl.py:228

        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #42c38f7bf9f0756a — Environment-variable access.

repo/lightrag/kg/redis_impl.py:628

        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c5e8b3f6c10eddbf — Environment-variable access.

repo/lightrag/kg/redis_impl.py:658

        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #913190d8220a9ca1 — Environment-variable access.

repo/lightrag/kg/redis_impl.py:658

        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #656a6c42954fa2fb — Filesystem access.

repo/lightrag/kg/shared_storage.py:584

        with open(f"/proc/{pid}/stat", "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #840b898a979fe057 — Environment-variable access.

repo/lightrag/lightrag.py:309

    workspace: str = field(default_factory=lambda: os.getenv("WORKSPACE", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #54de17a232cf7d36 — Environment-variable access.

repo/lightrag/lightrag.py:503

    embedding_batch_num: int = field(default=int(os.getenv("EMBEDDING_BATCH_NUM", 10)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #97a8cdca802a64f0 — Environment-variable access.

repo/lightrag/lightrag.py:507

        default=int(os.getenv("EMBEDDING_FUNC_MAX_ASYNC", 8))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a41a654976789b54 — Environment-variable access.

repo/lightrag/lightrag.py:525

        default=int(os.getenv("EMBEDDING_TIMEOUT", DEFAULT_EMBEDDING_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6286e15e3553940f — Environment-variable access.

repo/lightrag/lightrag.py:549

        default=int(os.getenv("SUMMARY_MAX_TOKENS", DEFAULT_SUMMARY_MAX_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3a5524cc7ea647f2 — Environment-variable access.

repo/lightrag/lightrag.py:554

        default=int(os.getenv("SUMMARY_CONTEXT_SIZE", DEFAULT_SUMMARY_CONTEXT_SIZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #af8f6a40fee48693 — Environment-variable access.

repo/lightrag/lightrag.py:560

            os.getenv("SUMMARY_LENGTH_RECOMMENDED", DEFAULT_SUMMARY_LENGTH_RECOMMENDED)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #db09cb1c95609204 — Environment-variable access.

repo/lightrag/lightrag.py:567

            os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1d66c0c113b40d1c — Environment-variable access.

repo/lightrag/lightrag.py:576

        default=int(os.getenv("LLM_TIMEOUT", DEFAULT_LLM_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f74c1c37709b791a — Environment-variable access.

repo/lightrag/lightrag.py:580

        default=os.getenv("ENTITY_EXTRACTION_USE_JSON", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5d3029fb2929bcd6 — Environment-variable access.

repo/lightrag/lightrag.py:596

            os.getenv(
                "MAX_ASYNC_RERANK",
                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b416224dc4f5aab5 — Environment-variable access.

repo/lightrag/lightrag.py:598

                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #65c437500e38f090 — Environment-variable access.

repo/lightrag/lightrag.py:607

        default=int(os.getenv("RERANK_TIMEOUT", DEFAULT_RERANK_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #63086d9e5c94f010 — Environment-variable access.

repo/lightrag/lightrag.py:644

        default=int(os.getenv("MAX_PARALLEL_INSERT", DEFAULT_MAX_PARALLEL_INSERT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d53ca27c4ff7bf3b — Environment-variable access.

repo/lightrag/lightrag.py:650

            os.getenv(
                "MAX_PARALLEL_PARSE_NATIVE", str(DEFAULT_MAX_PARALLEL_PARSE_NATIVE)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #45e8a4cdf4f287bb — Environment-variable access.

repo/lightrag/lightrag.py:657

            os.getenv(
                "MAX_PARALLEL_PARSE_MINERU", str(DEFAULT_MAX_PARALLEL_PARSE_MINERU)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3d95e4e6a2d5c145 — Environment-variable access.

repo/lightrag/lightrag.py:664

            os.getenv(
                "MAX_PARALLEL_PARSE_DOCLING", str(DEFAULT_MAX_PARALLEL_PARSE_DOCLING)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e92ed751fdd2abb9 — Environment-variable access.

repo/lightrag/lightrag.py:671

            os.getenv("MAX_PARALLEL_ANALYZE", str(DEFAULT_MAX_PARALLEL_ANALYZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3735ca755a467c04 — Environment-variable access.

repo/lightrag/lightrag.py:675

        default=int(os.getenv("QUEUE_SIZE_PARSE", str(DEFAULT_QUEUE_SIZE_PARSE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5c4865a10f1c6ec3 — Environment-variable access.

repo/lightrag/lightrag.py:678

        default=int(os.getenv("QUEUE_SIZE_ANALYZE", str(DEFAULT_QUEUE_SIZE_ANALYZE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #adc3e4830f66eadc — Environment-variable access.

repo/lightrag/lightrag.py:681

        default=int(os.getenv("QUEUE_SIZE_INSERT", str(DEFAULT_QUEUE_SIZE_INSERT)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4a6fbbd92cc44a29 — Environment-variable access.

repo/lightrag/lightrag.py:755

        default=float(os.getenv("COSINE_THRESHOLD", 0.2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3872663651c3f185 — Environment-variable access.

repo/lightrag/lightrag.py:837

                chunker_cfg["chunk_token_size"] = int(os.getenv("CHUNK_SIZE", 1200))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6666063a79435e64 — Environment-variable access.

repo/lightrag/lightrag.py:845

            legacy_overlap_default = int(os.getenv("CHUNK_OVERLAP_SIZE", 100))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7aeef1ca7597984c — Environment-variable access.

repo/lightrag/lightrag.py:874

        p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #560d71cbbc4cf62a — Environment-variable access.

repo/lightrag/lightrag.py:896

            size_raw = os.getenv(size_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ccc49303418e04f2 — Environment-variable access.

repo/lightrag/lightrag.py:988

        if os.getenv("ENTITY_TYPES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #799f04cd54986799 — Filesystem access.

repo/lightrag/llm/_vision_utils.py:273

        with open(path, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d8422ba4e9d001af — Environment-variable access.

repo/lightrag/llm/anthropic.py:78

        api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a6e40eb5ba0173d6 — Environment-variable access.

repo/lightrag/llm/binding_options.py:379

            env_raw = os.getenv(role_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #92282db0ea1cce6f — Environment-variable access.

repo/lightrag/llm/binding_options.py:806

        os.environ["OPENAI_LLM_REASONING"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #577c6589b33b7dd7 — Environment-variable access.

repo/lightrag/llm/binding_options.py:829

            if "OPENAI_LLM_REASONING" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5318db193ad3a408 — Environment-variable access.

repo/lightrag/llm/binding_options.py:830

                del os.environ["OPENAI_LLM_REASONING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #cc9e80d0b4f9da42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/llm/deprecated/siliconcloud.py:57

        async with session.post(base_url, headers=headers, json=payload) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #7d69c7b30e151db7 — Environment-variable access.

repo/lightrag/llm/gemini.py:98

    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0f9bcf3f84c8a871 — Environment-variable access.

repo/lightrag/llm/gemini.py:102

        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #15ab646f0273144f — Environment-variable access.

repo/lightrag/llm/gemini.py:104

            location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #25cb6f90bc3c44b7 — Environment-variable access.

repo/lightrag/llm/gemini.py:134

    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c0843b1b19d155e3 — Environment-variable access.

repo/lightrag/llm/gemini.py:139

    key = api_key or os.getenv("LLM_BINDING_API_KEY") or os.getenv("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2d53150e9841fdd1 — Environment-variable access.

repo/lightrag/llm/hf.py:32

os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #d8af97bc72271540 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/llm/jina.py:24

        async with session.post(url, headers=headers, json=data) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #ced8a6c323808165 — Environment-variable access.

repo/lightrag/llm/jina.py:120

        os.environ["JINA_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0bc4a95f1b234e3a — Environment-variable access.

repo/lightrag/llm/jina.py:122

    if "JINA_API_KEY" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #18c44cb5112b669d — Environment-variable access.

repo/lightrag/llm/jina.py:128

        "Authorization": f"Bearer {os.environ['JINA_API_KEY']}",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #d7d7e45977bd125e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/llm/lollms.py:133

                async with session.post(
                    f"{base_url}/lollms_generate", json=request_data
                ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #33b3d716e1f4b4e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/llm/lollms.py:141

            async with session.post(
                f"{base_url}/lollms_generate", json=request_data
            ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #35dc6a5a71c3f104 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/llm/lollms.py:205

            async with session.post(
                f"{base_url}/lollms_embed",
                json=request_data,
            ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #b73c7cf87e3b7abf — Environment-variable access.

repo/lightrag/llm/nvidia_openai.py:57

        os.environ["OPENAI_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ac90519d959c8f1d — Environment-variable access.

repo/lightrag/llm/ollama.py:147

        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #afd06f6e412cde39 — Environment-variable access.

repo/lightrag/llm/ollama.py:299

        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #369b10909edf2144 — Environment-variable access.

repo/lightrag/llm/openai.py:48

    langfuse_public_key = os.environ.get("LANGFUSE_PUBLIC_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #05ae1b4abd87bce1 — Environment-variable access.

repo/lightrag/llm/openai.py:49

    langfuse_secret_key = os.environ.get("LANGFUSE_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #24bc375e920f2301 — Environment-variable access.

repo/lightrag/llm/openai.py:110

EMBEDDING_USE_BASE64: bool = os.getenv("EMBEDDING_USE_BASE64", "true").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ed9edc3a30298c12 — Environment-variable access.

repo/lightrag/llm/openai.py:166

            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4681aa3a684f0013 — Environment-variable access.

repo/lightrag/llm/openai.py:166

            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(
                "LLM_BINDING_API_KEY"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0c91d360c25f551c — Environment-variable access.

repo/lightrag/llm/openai.py:192

            api_key = os.environ["OPENAI_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c42361e45285518b — Environment-variable access.

repo/lightrag/llm/openai.py:198

        dashscope_workspace_id = os.getenv("DASHSCOPE_WORKSPACE_ID", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cc7e8bb85ce1a0f4 — Environment-variable access.

repo/lightrag/llm/openai.py:215

            merged_configs["base_url"] = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #16c90ea664445b7c — Environment-variable access.

repo/lightrag/llm/openai.py:215

            merged_configs["base_url"] = os.environ.get(
                "OPENAI_API_BASE", "https://api.openai.com/v1"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #eb0f68d906270284 — Environment-variable access.

repo/lightrag/llm/openai.py:1114

    deployment = os.getenv("AZURE_OPENAI_DEPLOYMENT") or model or os.getenv("LLM_MODEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2278ae5546a257dd — Environment-variable access.

repo/lightrag/llm/openai.py:1116

        base_url or os.getenv("AZURE_OPENAI_ENDPOINT") or os.getenv("LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #74bc30812c996b8d — Environment-variable access.

repo/lightrag/llm/openai.py:1119

        api_key or os.getenv("AZURE_OPENAI_API_KEY") or os.getenv("LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7a0f0cd9e354ea85 — Environment-variable access.

repo/lightrag/llm/openai.py:1123

        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #89d7b9b1ce9e684b — Environment-variable access.

repo/lightrag/llm/openai.py:1124

        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b6c2072f4ee6b58f — Environment-variable access.

repo/lightrag/llm/openai.py:1164

        os.getenv("LLM_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #576cdc5aebaae53c — Environment-variable access.

repo/lightrag/llm/openai.py:1233

        os.getenv("AZURE_EMBEDDING_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b56a12084b4e6df0 — Environment-variable access.

repo/lightrag/llm/openai.py:1235

        or os.getenv("EMBEDDING_MODEL", "text-embedding-3-small")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a23ae70c1649263e — Environment-variable access.

repo/lightrag/llm/openai.py:1239

        or os.getenv("AZURE_EMBEDDING_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7f5a52f9adbb3531 — Environment-variable access.

repo/lightrag/llm/openai.py:1240

        or os.getenv("EMBEDDING_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #689d6ba11d1d5f30 — Environment-variable access.

repo/lightrag/llm/openai.py:1244

        or os.getenv("AZURE_EMBEDDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #89342fdfb0db65fe — Environment-variable access.

repo/lightrag/llm/openai.py:1245

        or os.getenv("EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #af1e8ed448b5be2d — Environment-variable access.

repo/lightrag/llm/openai.py:1249

        or os.getenv("AZURE_EMBEDDING_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #43fc1e885c549c59 — Environment-variable access.

repo/lightrag/llm/openai.py:1250

        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7df0e62b2d6a8a92 — Environment-variable access.

repo/lightrag/llm/openai.py:1251

        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cce918dc719a631b — Environment-variable access.

repo/lightrag/llm/voyageai.py:98

        api_key = os.environ.get("VOYAGE_API_KEY") or os.environ.get("VOYAGEAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #21a008bcca48e547 — Environment-variable access.

repo/lightrag/multimodal_context.py:697

    raw = os.getenv("CHUNK_R_SEPARATORS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6dd5e4f712d12ff5 — Environment-variable access.

repo/lightrag/multimodal_context.py:762

        raw = os.getenv(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2c9b57bb4fa1769f — Filesystem access.

repo/lightrag/multimodal_context.py:952

            payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0882b3bfebf0dcce — Filesystem access.

repo/lightrag/multimodal_context.py:997

            sidecar_path.write_text(
                json.dumps(payload, ensure_ascii=False, indent=2),
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3a05e977d0eb4598 — Filesystem access.

repo/lightrag/parser/docx/parse_document.py:118

        with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0b5106819e6fa291 — Filesystem access.

repo/lightrag/parser/docx/parser.py:163

            audit_path.write_text(
                json.dumps(audit, ensure_ascii=False, indent=2, sort_keys=True) + "\n",
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8cf49531ae73030a — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/guardrails.py:56

    raw = os.getenv(env_name) or default

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #995be07237209161 — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/guardrails.py:64

        return int(os.getenv(env_name, "") or default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6ff08f6d60905ade — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/guardrails.py:105

    raw = os.getenv("DOCX_SMART_HEADING_MAX_CHARS", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cf52113f8c9d7e97 — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/heading_flow.py:74

        return float(os.getenv(env_name, "") or default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8b5de2c79a115562 — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/heading_flow.py:81

        return int(os.getenv(env_name, "") or default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #073b563cdfe349a5 — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/heading_flow.py:1538

            os.getenv("DOCX_SMART_SEQ_BREAK_PARAS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ed9f0f1fb46ef9d5 — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/title_block.py:76

        return int(os.getenv(env_name, "") or default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3fd7c33ae2970053 — Environment-variable access.

repo/lightrag/parser/docx/smart_heading/title_block.py:83

        return float(os.getenv(env_name, "") or default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c9a29a9f4ae09a81 — Environment-variable access.

repo/lightrag/parser/docx/utils.py:90

    return os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0fd335120f00422d — Environment-variable access.

repo/lightrag/parser/docx/utils.py:121

        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3b6f14c5203ec1a0 — Environment-variable access.

repo/lightrag/parser/docx/utils.py:122

        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b731b3dcfb562f4a — Environment-variable access.

repo/lightrag/parser/docx/utils.py:123

        base_url = os.getenv("GOOGLE_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #89a4984659e639df — Environment-variable access.

repo/lightrag/parser/docx/utils.py:143

        api_key = os.getenv("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #95e3db54659fbd0b — Environment-variable access.

repo/lightrag/parser/docx/utils.py:164

        project = os.getenv("GOOGLE_CLOUD_PROJECT", "unknown")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9bb72064802bca93 — Environment-variable access.

repo/lightrag/parser/docx/utils.py:165

        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #03dc652b13224afb — Environment-variable access.

repo/lightrag/parser/docx/utils.py:189

    api_key = os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9d3966ef0957269b — Environment-variable access.

repo/lightrag/parser/docx/utils.py:193

    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0d85311d0e7eedd0 — Environment-variable access.

repo/lightrag/parser/docx/utils.py:207

    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #03585e4aa30cc95e — Environment-variable access.

repo/lightrag/parser/external/_common.py:70

    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f38aac04de9c593 — Environment-variable access.

repo/lightrag/parser/external/_common.py:79

    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #193cca80ec4f8437 — Environment-variable access.

repo/lightrag/parser/external/_common.py:93

    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #32c0678a6c926269 — Filesystem access.

repo/lightrag/parser/external/_manifest.py:132

        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #96672f1e1dc6f574 — Filesystem access.

repo/lightrag/parser/external/_manifest.py:152

    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aacaac8ce5adeac1 — Environment-variable access.

repo/lightrag/parser/external/docling/cache.py:84

    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #63832fa093423784 — Environment-variable access.

repo/lightrag/parser/external/docling/cache.py:138

        "DOCLING_OCR_ENGINE": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #13dc3701dbead903 — Environment-variable access.

repo/lightrag/parser/external/docling/cache.py:139

        "DOCLING_OCR_PRESET": os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b2cd37a06c01170e — Environment-variable access.

repo/lightrag/parser/external/docling/cache.py:140

        "DOCLING_OCR_LANG": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #98ef342e36334a3c — Environment-variable access.

repo/lightrag/parser/external/docling/cache.py:177

    cur_engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #414a0a2c2b6413f8 — Environment-variable access.

repo/lightrag/parser/external/docling/client.py:111

        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f37cc83d27b12418 — Environment-variable access.

repo/lightrag/parser/external/docling/client.py:119

        self.ocr_engine = os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c0b0b88d11ad1707 — Environment-variable access.

repo/lightrag/parser/external/docling/client.py:120

        self.ocr_preset = os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3b3499ed19919aa5 — Environment-variable access.

repo/lightrag/parser/external/docling/client.py:121

        self.ocr_lang_raw = os.getenv("DOCLING_OCR_LANG", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #02506cefba19f695 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/docling/client.py:243

            resp = await client.post(
                url, data=self._build_multipart_data(), files=files
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #1e9d44ededea63b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/docling/client.py:263

            resp = await client.get(url, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #cb7d09d1a31d3d12 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/docling/client.py:304

        resp = await client.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #94f76cb436089cb0 — Filesystem access.

repo/lightrag/parser/external/docling/client.py:403

    (raw_dir / f"{stem}.json").write_text(
        json.dumps(document, ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #754ceffd9cf69610 — Filesystem access.

repo/lightrag/parser/external/docling/client.py:408

        (raw_dir / f"{stem}.md").write_text(str(markdown), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0f672249d9937da1 — Environment-variable access.

repo/lightrag/parser/external/docling/ir_builder.py:81

        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d6e3f650f1942bd1 — Filesystem access.

repo/lightrag/parser/external/docling/ir_builder.py:109

            doc = json.loads(main_json.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e2fb266f5d7cc5a0 — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:109

    mode = _normalize_api_mode(os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d7ce398d20c686df — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:119

    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #96d1292a50e18984 — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:128

    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #eb8c64bcf0e9f2e4 — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:144

            os.getenv("MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9c7fe0cec6d69239 — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:149

        return os.getenv("MINERU_LOCAL_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c52ee1f8da85f03b — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:220

            overrides.get("page_range", os.getenv("MINERU_PAGE_RANGES", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d725a1af0de4b04b — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:225

                    "language", os.getenv("MINERU_LANGUAGE", DEFAULT_MINERU_LANGUAGE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a161647f1389996c — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:234

                    os.getenv(
                        "MINERU_LOCAL_PARSE_METHOD", DEFAULT_MINERU_LOCAL_PARSE_METHOD
                    ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ba33b3dc2dbc179d — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:252

                os.getenv("MINERU_MODEL_VERSION", DEFAULT_MINERU_MODEL_VERSION).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6dd21b4486ea7751 — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:263

                os.getenv("MINERU_LOCAL_BACKEND", DEFAULT_MINERU_LOCAL_BACKEND).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9e446762d4769e96 — Environment-variable access.

repo/lightrag/parser/external/mineru/cache.py:379

    cur_engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f6c8d84b9b089b9b — Environment-variable access.

repo/lightrag/parser/external/mineru/client.py:122

            os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE).strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f128b5b901d52fb0 — Environment-variable access.

repo/lightrag/parser/external/mineru/client.py:131

            os.getenv(
                "MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT
            ).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #092d9085bc9c8e48 — Environment-variable access.

repo/lightrag/parser/external/mineru/client.py:137

            os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0f5b212451c259df — Environment-variable access.

repo/lightrag/parser/external/mineru/client.py:139

        self.api_token = os.getenv("MINERU_API_TOKEN", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cf1f018670ef8f48 — Environment-variable access.

repo/lightrag/parser/external/mineru/client.py:162

        self.poll_interval = float(os.getenv("MINERU_POLL_INTERVAL_SECONDS", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9f1ef78e28038bb1 — Environment-variable access.

repo/lightrag/parser/external/mineru/client.py:164

        self.max_polls = int(os.getenv("MINERU_MAX_POLLS", "600"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #917bee7512e6c4a7 — Environment-variable access.

repo/lightrag/parser/external/mineru/client.py:165

        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #6ecb1e1a9613263e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/mineru/client.py:271

        resp = await client.post(
            apply_url,
            headers=self._official_headers(),
            json=self._official_payload(upload_name),
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #c09b5de40144b01f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/mineru/client.py:300

        upload_resp = await client.put(
            upload_url,
            content=_iter_file_bytes(source_file_path),
            headers={"Content-Length": str(source_file_path.stat().st_size)},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #679cda7e39a35d8e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/mineru/client.py:323

            resp = await client.get(poll_url, headers=self._official_headers())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #873803a562fdf970 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/mineru/client.py:393

            resp = await client.post(
                submit_url,
                data=self._local_form_data(),
                files=files,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #c4b00492ba438a4e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/mineru/client.py:428

            resp = await client.get(poll_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress production #947f116d32319e61 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/external/mineru/client.py:451

            resp = await client.get(result_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #ace5e88ae42b005b — Filesystem access.

repo/lightrag/parser/external/mineru/client.py:679

            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c7bbf5c2cf6658f7 — Environment-variable access.

repo/lightrag/parser/external/mineru/ir_builder.py:86

        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #42f388b7fb42b324 — Environment-variable access.

repo/lightrag/parser/external/mineru/ir_builder.py:90

        self.image_url_template = os.getenv("MINERU_IMAGE_URL_TEMPLATE", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #40e5ac0ea90ba1d0 — Environment-variable access.

repo/lightrag/parser/external/mineru/ir_builder.py:95

        raw = os.getenv("MINERU_BBOX_ATTRIBUTES", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #927e73231ed5f875 — Filesystem access.

repo/lightrag/parser/external/mineru/ir_builder.py:139

        content_list = json.loads(content_list_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e90d3e0ac0b404d8 — Filesystem access.

repo/lightrag/parser/external/mineru/manifest.py:126

        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #926ce0942b1b7a62 — Filesystem access.

repo/lightrag/parser/external/mineru/manifest.py:147

    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0b491444c2664932 — Environment-variable access.

repo/lightrag/parser/legacy/parser.py:47

        pdf_password = os.getenv("PDF_DECRYPT_PASSWORD") or None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c7a4c045c4b83c4b — Environment-variable access.

repo/lightrag/parser/markdown/parser.py:209

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6e0b3c7504064597 — Environment-variable access.

repo/lightrag/parser/markdown/parser.py:216

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #91d042beb8297b58 — Environment-variable access.

repo/lightrag/parser/markdown/parser.py:228

    raw = os.getenv("NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #814f9e6d3317d452 — Filesystem access.

repo/lightrag/parser/markdown/parser.py:544

        data = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #e9e697339ade1370 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/parser/markdown/parser.py:599

        with opener.open(req, timeout=self._timeout) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #08858866e747edf9 — Filesystem access.

repo/lightrag/parser/markdown/parser.py:675

            md_text = source.read_bytes().decode("utf-8-sig")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #795d7eaf49fb7097 — Filesystem access.

repo/lightrag/parser/markdown/parser.py:693

            source.read_bytes(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9db0468a4649d544 — Filesystem access.

repo/lightrag/parser/markdown/parser.py:699

        return text_file.read_bytes().decode("utf-8-sig"), text_file.parent

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #325eb6ea216faedf — Environment-variable access.

repo/lightrag/parser/markdown/raw_cache.py:49

        "max_bytes": os.getenv("NATIVE_MD_IMAGE_MAX_BYTES", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6ed807c2c85892b8 — Environment-variable access.

repo/lightrag/parser/markdown/raw_cache.py:50

        "max_svg_pixels": os.getenv("NATIVE_MD_IMAGE_MAX_SVG_PIXELS", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #40292058f44f2750 — Environment-variable access.

repo/lightrag/parser/markdown/raw_cache.py:51

        "allowed_non_public_cidrs": os.getenv(
            "NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", ""
        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fd92b28dea42bd5a — Filesystem access.

repo/lightrag/parser/markdown/raw_cache.py:136

            data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8035b3c750dba794 — Filesystem access.

repo/lightrag/parser/markdown/raw_cache.py:194

            tmp.write_text(
                json.dumps(manifest, ensure_ascii=False, indent=2), encoding="utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f655e1a1930b7fe1 — Filesystem access.

repo/lightrag/parser/markdown/raw_cache.py:214

            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #bc305401d6dd0ef1 — Environment-variable access.

repo/lightrag/parser/param_schema.py:416

    return (os.getenv("MINERU_API_MODE", "") or "").strip().lower() != "official"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #39669775020ceb62 — Environment-variable access.

repo/lightrag/parser/registry.py:45

    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e6489a436e635664 — Environment-variable access.

repo/lightrag/parser/registry.py:47

        return bool(os.getenv("MINERU_API_TOKEN", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #7a7406500ee5af18 — Environment-variable access.

repo/lightrag/parser/registry.py:49

        return bool(os.getenv("MINERU_LOCAL_ENDPOINT", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #90ceeea18c4dcf6c — Environment-variable access.

repo/lightrag/parser/registry.py:54

    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6b8e9c6e5ac168bb — Environment-variable access.

repo/lightrag/parser/registry.py:64

    return lambda: bool(os.getenv(env_name, "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2e05ac0f10819403 — Environment-variable access.

repo/lightrag/parser/routing.py:320

            p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1db3847c1097bd5a — Environment-variable access.

repo/lightrag/parser/routing.py:331

        if os.getenv("CHUNK_P_DROP_REFERENCES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0d63fd3f99e445be — Environment-variable access.

repo/lightrag/parser/routing.py:340

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8d301a85fd435e1b — Environment-variable access.

repo/lightrag/parser/routing.py:350

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1362e383a82b21ed — Environment-variable access.

repo/lightrag/parser/routing.py:401

                os.getenv("CHUNK_R_SEPARATORS", json.dumps(list(DEFAULT_R_SEPARATORS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0d06680754198b03 — Environment-variable access.

repo/lightrag/parser/routing.py:405

            "breakpoint_threshold_type": os.getenv(
                "CHUNK_V_BREAKPOINT_THRESHOLD_TYPE", "percentile"
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #432378db80e2c474 — Environment-variable access.

repo/lightrag/parser/routing.py:409

                os.getenv("CHUNK_V_BREAKPOINT_THRESHOLD_AMOUNT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #71b2dbedd178ba77 — Environment-variable access.

repo/lightrag/parser/routing.py:411

            "buffer_size": int(os.getenv("CHUNK_V_BUFFER_SIZE", "1")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #478482bc44d13e88 — Environment-variable access.

repo/lightrag/parser/routing.py:416

            "sentence_split_regex": os.getenv(
                "CHUNK_V_SENTENCE_SPLIT_REGEX", DEFAULT_SENTENCE_SPLIT_REGEX
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c4ed60f06697249d — Environment-variable access.

repo/lightrag/parser/routing.py:426

    f_overlap_raw = os.getenv("CHUNK_F_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d54104e3ba6d066d — Environment-variable access.

repo/lightrag/parser/routing.py:429

    r_overlap_raw = os.getenv("CHUNK_R_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2e7c4ac4d2d41693 — Environment-variable access.

repo/lightrag/parser/routing.py:432

    p_overlap_raw = os.getenv("CHUNK_P_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0471a8a554cec718 — Environment-variable access.

repo/lightrag/parser/routing.py:446

    p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e9a7351d55849b22 — Environment-variable access.

repo/lightrag/parser/routing.py:457

    f_size_raw = os.getenv("CHUNK_F_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #25c52b492d9caf32 — Environment-variable access.

repo/lightrag/parser/routing.py:460

    r_size_raw = os.getenv("CHUNK_R_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #21b3606eea291c48 — Environment-variable access.

repo/lightrag/parser/routing.py:463

    v_size_raw = os.getenv("CHUNK_V_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9050db3ecfdf1a52 — Environment-variable access.

repo/lightrag/parser/routing.py:921

    return os.getenv("LIGHTRAG_PARSER", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #21febbddecdabc9d — Environment-variable access.

repo/lightrag/parser/routing.py:1030

    raw = os.getenv("DOCX_SMART_HEADING", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #698210b4724a8252 — Filesystem access.

repo/lightrag/pipeline.py:3695

            lines = block_file.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d611696348deaccf — Environment-variable access.

repo/lightrag/pipeline.py:3730

                int(os.getenv("VLM_MAX_IMAGE_BYTES", str(5 * 1024 * 1024))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b071208c5b84142f — Environment-variable access.

repo/lightrag/pipeline.py:3734

                int(os.getenv("VLM_MIN_IMAGE_PIXEL", str(DEFAULT_MM_IMAGE_MIN_PIXEL))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c46453c7754a3587 — Filesystem access.

repo/lightrag/pipeline.py:3974

                    raw = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ae0cb7ecb8542aea — Filesystem access.

repo/lightrag/pipeline.py:4360

                    payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #fa418031cc796fb9 — Filesystem access.

repo/lightrag/pipeline.py:4488

                    sidecar_path.write_text(
                        json.dumps(payload, ensure_ascii=False, indent=2),
                        encoding="utf-8",
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cc0e22746e6c5973 — Filesystem access.

repo/lightrag/pipeline.py:4682

                payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6b2dca9768546c1d — Environment-variable access.

repo/lightrag/prompt.py:562

    configured = os.getenv("PROMPT_DIR", "").strip() or _DEFAULT_PROMPT_DIR

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3f8af587ccf13ae5 — Filesystem access.

repo/lightrag/prompt.py:635

        content = profile_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #9f32d41a2912d651 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

repo/lightrag/rerank.py:308

        async with session.post(base_url, headers=headers, json=payload) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #73300718f5b7be2d — Environment-variable access.

repo/lightrag/rerank.py:435

        api_key = os.getenv("COHERE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f12673b69c74e1fc — Environment-variable access.

repo/lightrag/rerank.py:477

        api_key = os.getenv("JINA_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2ff737cbc50e123c — Environment-variable access.

repo/lightrag/rerank.py:517

        api_key = os.getenv("DASHSCOPE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2d550aa3064cddff — Filesystem access.

repo/lightrag/sidecar/writer.py:332

    blocks_path.write_text(
        "\n".join([json.dumps(meta, ensure_ascii=False)] + blocks_lines) + "\n",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ebcef2c50dd045f2 — Filesystem access.

repo/lightrag/sidecar/writer.py:341

        tables_path.write_text(
            json.dumps(
                {"version": "1.0", "tables": tables},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #31b0a25c262ad1d3 — Filesystem access.

repo/lightrag/sidecar/writer.py:351

        drawings_path.write_text(
            json.dumps(
                {"version": "1.0", "drawings": drawings},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #476a3344690bf2bf — Filesystem access.

repo/lightrag/sidecar/writer.py:361

        equations_path.write_text(
            json.dumps(
                {"version": "1.0", "equations": equations},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d755d01c1f185c03 — Environment-variable access.

repo/lightrag/tools/clean_llm_query_cache.py:141

            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #33a0656386fe6218 — Environment-variable access.

repo/lightrag/tools/clean_llm_query_cache.py:146

        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #102006b3cc8446f8 — Environment-variable access.

repo/lightrag/tools/clean_llm_query_cache.py:198

        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6985f1d27db2d1e0 — Environment-variable access.

repo/lightrag/tools/clean_llm_query_cache.py:266

            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0a8bfcf4c0984b5f — Environment-variable access.

repo/lightrag/tools/download_cache.py:126

        os.environ["TIKTOKEN_CACHE_DIR"] = cache_dir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d3603e9cea91e241 — Environment-variable access.

repo/lightrag/tools/download_cache.py:132

        env_cache_dir = os.environ.get("TIKTOKEN_CACHE_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e1d1398192078ed1 — Environment-variable access.

repo/lightrag/tools/kg_integrity_repair.py:220

        working_dir=os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #0403f69a576e5ae8 — Environment-variable access.

repo/lightrag/tools/kg_integrity_repair.py:221

        workspace=os.getenv("WORKSPACE", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e12b1e2f5c3711d8 — Environment-variable access.

repo/lightrag/tools/kg_integrity_repair.py:224

            embedding_dim=int(os.getenv("EMBEDDING_DIM", "1024")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #22807a6eea401559 — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:126

            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8ee0905296a32bb4 — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:131

        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9d515637ff054119 — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:183

        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #57117c877a75ce67 — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:219

                has_env = all(var in os.environ for var in required_vars)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8267df3428a525ad — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:279

            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #716db953ee494836 — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:1090

                    if "REDIS_URI" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d178fc0d2f0a670b — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:1098

                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3ab71639d7320672 — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:1108

                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #83ad6b1891802ffa — Environment-variable access.

repo/lightrag/tools/migrate_llm_cache.py:1118

                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e72147c6d176117d — Environment-variable access.

repo/lightrag/tools/prepare_qdrant_legacy_data.py:154

                url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #08c22e8a40319006 — Environment-variable access.

repo/lightrag/tools/prepare_qdrant_legacy_data.py:154

                url=os.environ.get(
                    "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f8893a20c213706c — Environment-variable access.

repo/lightrag/tools/prepare_qdrant_legacy_data.py:157

                api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #619042d3c33b749e — Environment-variable access.

repo/lightrag/tools/prepare_qdrant_legacy_data.py:157

                api_key=os.environ.get(
                    "QDRANT_API_KEY",
                    config.get("qdrant", "apikey", fallback=None),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #c47473f49ada0edd — Environment-variable access.

repo/lightrag/tools/rebuild_vdb.py:584

            "graph": os.getenv("LIGHTRAG_GRAPH_STORAGE", "NetworkXStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #afd8ade511740571 — Environment-variable access.

repo/lightrag/tools/rebuild_vdb.py:585

            "vector": os.getenv("LIGHTRAG_VECTOR_STORAGE", "NanoVectorDBStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #de971a8dfc47cc49 — Environment-variable access.

repo/lightrag/tools/rebuild_vdb.py:586

            "kv": os.getenv("LIGHTRAG_KV_STORAGE", "JsonKVStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4327622580095513 — Environment-variable access.

repo/lightrag/tools/rebuild_vdb.py:592

        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ce755b5120c9194b — Environment-variable access.

repo/lightrag/tools/rebuild_vdb.py:625

            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e1e6c59410ee0c83 — Environment-variable access.

repo/lightrag/tools/rebuild_vdb.py:654

                    os.getenv("TIKTOKEN_MODEL_NAME", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aab97a35e0d2875e — Environment-variable access.

repo/lightrag/tools/rebuild_vdb.py:666

        self.workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a97a11ac1aad521c — Environment-variable access.

repo/lightrag/utils.py:270

    value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #77a95e6b578b09c2 — Environment-variable access.

repo/lightrag/utils.py:316

VERBOSE_DEBUG = os.getenv("VERBOSE", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ec7a4491e23117b3 — Environment-variable access.

repo/lightrag/utils.py:318

    os.getenv("LIGHTRAG_PERFORMANCE_TIMING_LOGS", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #68600f15b6b6a2a8 — Environment-variable access.

repo/lightrag/utils.py:443

            log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #224e8d4559eaf2fc — Filesystem access.

repo/lightrag/utils.py:2375

    with open(file_name, encoding="utf-8-sig") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #599429b08aa5fb3c — Filesystem access.

repo/lightrag/utils.py:2493

            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1459f9a256ff4724 — Filesystem access.

repo/lightrag/utils.py:2500

            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #06c0644e7a5beea0 — Filesystem access.

repo/lightrag/utils.py:3296

        with open(output_path, "w", newline="", encoding="utf-8") as csvfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #64944674b7218cb6 — Filesystem access.

repo/lightrag/utils.py:3346

        with open(output_path, "w", encoding="utf-8") as mdfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9f509524e71ed181 — Filesystem access.

repo/lightrag/utils.py:3408

        with open(output_path, "w", encoding="utf-8") as txtfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a6998b8e5d815516 — Environment-variable access.

repo/lightrag/utils.py:4120

    missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #556a25a8239ac92d — Environment-variable access.

repo/lightrag/utils_pipeline.py:608

    input_dir = os.getenv("INPUT_DIR", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #aa20b013729f0e49 — Filesystem access.

repo/reproduce/Step_0.py:24

            with open(file_path, "r", encoding="utf-8") as infile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2b796b46df748a31 — Filesystem access.

repo/reproduce/Step_0.py:51

            with open(output_path, "w", encoding="utf-8") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4192138df6318468 — Filesystem access.

repo/reproduce/Step_1.py:10

    with open(file_path, mode="r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e9ecf9c73143c5ca — Environment-variable access.

repo/reproduce/Step_1_openai_compatible.py:22

        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #87f29430322d4c6d — Environment-variable access.

repo/reproduce/Step_1_openai_compatible.py:32

        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #986891d892851dd2 — Filesystem access.

repo/reproduce/Step_1_openai_compatible.py:41

    with open(file_path, mode="r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #23f12260c93fac49 — Filesystem access.

repo/reproduce/Step_2.py:41

    with open(f"../datasets/unique_contexts/{cls}_unique_contexts.json", mode="r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d156ab9146f4cac4 — Filesystem access.

repo/reproduce/Step_2.py:75

    with open(file_path, "w") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5caf04f9504cd6de — Filesystem access.

repo/reproduce/Step_3.py:8

    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3c6f54f90a6948a4 — Filesystem access.

repo/reproduce/Step_3.py:32

        open(output_file, "a", encoding="utf-8") as result_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e4af40faa60a6ef7 — Filesystem access.

repo/reproduce/Step_3.py:33

        open(error_file, "a", encoding="utf-8") as err_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cabd862d7b8ead0b — Environment-variable access.

repo/reproduce/Step_3_openai_compatible.py:20

        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ab6416f1f685a67f — Environment-variable access.

repo/reproduce/Step_3_openai_compatible.py:30

        api_key=os.getenv("UPSTAGE_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2915a89618b47a24 — Filesystem access.

repo/reproduce/Step_3_openai_compatible.py:39

    with open(file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #a1526e6889ba4330 — Filesystem access.

repo/reproduce/Step_3_openai_compatible.py:63

        open(output_file, "a", encoding="utf-8") as result_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #e951de1fc746749a — Filesystem access.

repo/reproduce/Step_3_openai_compatible.py:64

        open(error_file, "a", encoding="utf-8") as err_file,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #6ef5a74ed99a1a8f — Filesystem access.

repo/reproduce/batch_eval.py:11

    with open(query_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #35753ac36fbc6003 — Filesystem access.

repo/reproduce/batch_eval.py:16

    with open(result1_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d26d22c634b91919 — Filesystem access.

repo/reproduce/batch_eval.py:20

    with open(result2_file, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #5f920ef2485ae64d — Filesystem access.

repo/reproduce/batch_eval.py:97

        file=open(output_file_path, "rb"), purpose="batch"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #f34ba86e91e533bd — Filesystem access.

repo/scripts/release/set_version.py:46

    content = VERSION_FILE.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only Excluded from app score #34b3ca46182a02c2 — Filesystem access.

repo/scripts/release/set_version.py:51

    VERSION_FILE.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

langfuse

python dependency

medium telemetry dependency Excluded from app score #91bf5e51677be292 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/client.py:32

from opentelemetry import context as otel_context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #afa4dd2625ff5b10 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/client.py:33

from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #af2890bd933aba1b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/client.py:34

from opentelemetry.sdk.trace import ReadableSpan, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f7271a4c078be484 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/client.py:35

from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #1a6df051ce8f6c31 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/client.py:36

from opentelemetry.sdk.trace.id_generator import IdGenerator, RandomIdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2bf3f305394578ad — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/client.py:37

from opentelemetry.util._decorator import (
    _AgnosticContextManager,
    _agnosticcontextmanager,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #6dd5a420fc903179 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/observe.py:22

from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b3717a3d5adcd2f5 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/propagation.py:23

from opentelemetry import (
    baggage,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #d4045e55e1f4b4a8 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/propagation.py:26

from opentelemetry import (
    baggage as otel_baggage_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5b0658160d93603f — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/propagation.py:29

from opentelemetry import (
    context as otel_context_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #17c7338cc5865b8b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/propagation.py:32

from opentelemetry import (
    trace as otel_trace_api,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #07e9a66511efeb5e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/propagation.py:35

from opentelemetry.context import _RUNTIME_CONTEXT

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #94fca75fc15800c1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/propagation.py:36

from opentelemetry.util._decorator import (
    _AgnosticContextManager,
    _agnosticcontextmanager,

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a90cbbb95fd57d0d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:27

from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4dfd616e4ca764e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:28

from opentelemetry.sdk.resources import Resource

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #27f4b0c85a49e0bf — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:29

from opentelemetry.sdk.trace import ReadableSpan, TracerProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #224a86c57d1007a3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:30

from opentelemetry.sdk.trace.export import SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a8ab0c5a8a793d22 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:31

from opentelemetry.sdk.trace.id_generator import IdGenerator

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e80e04caa91138d7 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:32

from opentelemetry.sdk.trace.sampling import Decision, TraceIdRatioBased

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0c02036060e8f01a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:33

from opentelemetry.trace import Tracer

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #ac0a5f1bba5ac8e1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span.py:30

from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #5dae7dd844529888 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span.py:31

from opentelemetry.trace.status import Status, StatusCode

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #415f02b2ba02e03a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span.py:32

from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #a019c46067a2c6e1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_exporter.py:7

from opentelemetry.attributes import BoundedAttributes

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #fa76b3d40ad1019c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_exporter.py:8

from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f40cb9ca9a97509a — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_exporter.py:9

from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #77adee79399c049c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_exporter.py:10

from opentelemetry.sdk.util import BoundedList

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #559e53aa456dbde4 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_exporter.py:11

from opentelemetry.trace import format_span_id, format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b3854f8299b3e3e1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_exporter.py:12

from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #bb0a2c89326b414e — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_filter.py:7

from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b0520a608576b544 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:19

from opentelemetry import context as context_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #69877c945c04a68c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:20

from opentelemetry.context import Context

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #eed5cad7e29c5c0b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:21

from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #26b3759178abd3cd — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:22

from opentelemetry.sdk.trace import ReadableSpan, Span

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #896f2c613694e3dc — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:23

from opentelemetry.sdk.trace.export import BatchSpanProcessor, SpanExporter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #4955541ebda399a3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:24

from opentelemetry.trace import format_span_id, format_trace_id

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #cc14a9a76287ad95 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/utils.py:14

from opentelemetry import trace as otel_trace_api

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #59c445f267a60f76 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/utils.py:15

from opentelemetry.sdk import util

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #2e482fc1fa9e64be — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/_client/utils.py:16

from opentelemetry.sdk.trace import ReadableSpan

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c9649b193db2b32c — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/langchain/CallbackHandler.py:19

from opentelemetry import context, trace

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #0aa5d792a2e655ad — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/langchain/CallbackHandler.py:20

from opentelemetry.util._decorator import _AgnosticContextManager

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #3770c52d9671ff13 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/langfuse/types.py:33

from opentelemetry.util.types import AttributeValue

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 58 low-confidence finding(s)

low env_fs dependency Excluded from app score #f72619683c2c72f7 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:317

            or os.environ.get(LANGFUSE_BASE_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27987e5a91b9114b — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:319

            or os.environ.get(LANGFUSE_HOST, "https://cloud.langfuse.com")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61a592798d418038 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:322

            str, os.environ.get(LANGFUSE_TRACING_ENVIRONMENT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbb9cc0a0ae00b39 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:326

            or os.environ.get(LANGFUSE_RELEASE, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d18764ea4f657708 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:330

        sample_rate = sample_rate or float(os.environ.get(LANGFUSE_SAMPLE_RATE, 1.0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #622a83400839b3d1 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:336

        timeout = timeout or int(os.environ.get(LANGFUSE_TIMEOUT, 5))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0bb3ffd0192edaf9 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:340

            and os.environ.get(LANGFUSE_TRACING_ENABLED, "true").lower() != "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd6e274c5ae0c685 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:348

            debug if debug else (os.getenv(LANGFUSE_DEBUG, "false").lower() == "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9c86412883d48da — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:356

        public_key = public_key or os.environ.get(LANGFUSE_PUBLIC_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85a7754a9e48dcaf — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:365

        secret_key = secret_key or os.environ.get(LANGFUSE_SECRET_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c37a22c1587df6f — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/client.py:374

        if os.environ.get("OTEL_SDK_DISABLED", "false").lower() == "true":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e72d8e8e3b815aa2 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/observe.py:172

        function_io_capture_enabled = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2e6877457278174 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/observe.py:172

        function_io_capture_enabled = os.environ.get(
            LANGFUSE_OBSERVE_DECORATOR_IO_CAPTURE_ENABLED, "True"
        ).lower() not in ("false", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79d60689edd860a3 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:231

        self._media_upload_enabled = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e038c6231a1c79fb — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:231

        self._media_upload_enabled = os.environ.get(
            LANGFUSE_MEDIA_UPLOAD_ENABLED, "True"
        ).lower() not in ("false", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e6c358ca47be60f — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:236

            int(os.getenv(LANGFUSE_MEDIA_UPLOAD_THREAD_COUNT, 1)), 1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd291b69700c03b2 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:434

            os.environ["no_proxy"] = "*"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d1a04b6f797ef0e — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:435

            os.environ["NO_PROXY"] = "*"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e8a363de8f829ca — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:631

    environment = environment or os.environ.get(LANGFUSE_TRACING_ENVIRONMENT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eaece223d2172a54 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/resource_manager.py:632

    release = release or os.environ.get(LANGFUSE_RELEASE) or get_common_release_envs()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b07e70f4ef9a0139 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:89

        env_flush_at = os.environ.get(LANGFUSE_FLUSH_AT, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bb07828d0ff82a0 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:93

        env_flush_interval = os.environ.get(LANGFUSE_FLUSH_INTERVAL, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #741493db07fa7cdc — Environment-variable access.

pkgs/python/[email protected]/langfuse/_client/span_processor.py:113

            traces_export_path = os.environ.get(LANGFUSE_OTEL_TRACES_EXPORT_PATH, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa1e8bb01636ed48 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_task_manager/media_manager.py:45

        self._enabled = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #018601ce4472e55c — Environment-variable access.

pkgs/python/[email protected]/langfuse/_task_manager/media_manager.py:45

        self._enabled = os.environ.get(
            LANGFUSE_MEDIA_UPLOAD_ENABLED, "True"
        ).lower() not in ("false", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #53b82fff80a56257 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/_task_manager/media_manager.py:382

            response = self._httpx_client.put(
                upload_url,
                headers=headers,
                content=data["content_bytes"],
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #56a2c37f3d258d09 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_task_manager/score_ingestion_consumer.py:18

MAX_EVENT_SIZE_BYTES = int(os.environ.get("LANGFUSE_MAX_EVENT_SIZE_BYTES", 1_000_000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #931f92256c6e6fb2 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_task_manager/score_ingestion_consumer.py:19

MAX_BATCH_SIZE_BYTES = int(os.environ.get("LANGFUSE_MAX_BATCH_SIZE_BYTES", 2_500_000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9694a9931a01498 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_utils/environment.py:32

        if env in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a08e3a73fa89570 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_utils/environment.py:33

            return os.environ[env]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f94985060e5bd92 — Environment-variable access.

pkgs/python/[email protected]/langfuse/_utils/prompt_cache.py:17

    os.getenv(LANGFUSE_PROMPT_CACHE_DEFAULT_TTL_SECONDS, 60)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #4359641275ccf0a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/_utils/request.py:63

        res = self._session.post(
            url, content=data, headers=headers, timeout=self._timeout
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d1f18011df3d2696 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/dataset_items/client.py:138

        _response = self._raw_client.get(id, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #88fa7ea2a4250712 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/dataset_items/client.py:380

        _response = await self._raw_client.get(id, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2c9170c5cad7613a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/datasets/client.py:113

        _response = self._raw_client.get(dataset_name, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c7a485c8d77611a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/datasets/client.py:427

        _response = await self._raw_client.get(
            dataset_name, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7015c40b74a852a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/legacy/observations_v1/client.py:66

        _response = self._raw_client.get(
            observation_id, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4bede552441e4a23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/legacy/observations_v1/client.py:322

        _response = await self._raw_client.get(
            observation_id, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #52c4514fceb9623e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/media/client.py:66

        _response = self._raw_client.get(media_id, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #09a8db345844f503 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/media/client.py:277

        _response = await self._raw_client.get(
            media_id, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #efa9ff03a67feb27 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/models/client.py:216

        _response = self._raw_client.get(id, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #78f03058ec9f4079 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/models/client.py:478

        _response = await self._raw_client.get(id, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8408a1408bbcc953 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/prompts/client.py:82

        _response = self._raw_client.get(
            prompt_name,
            version=version,
            label=label,
            resolve=resolve,
            request_options=request_options,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e8c8928bc7240fe6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/prompts/client.py:342

        _response = await self._raw_client.get(
            prompt_name,
            version=version,
            label=label,
            resolve=resolve,
            request_options=request_options,
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f101fd27d73a3eb4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/sessions/client.py:136

        _response = self._raw_client.get(session_id, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ff754f8c37028c83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/sessions/client.py:279

        _response = await self._raw_client.get(
            session_id, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1a90e6f9981ce34f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/trace/client.py:73

        _response = self._raw_client.get(
            trace_id, fields=fields, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #15bffc99a0a55765 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/trace/client.py:429

        _response = await self._raw_client.get(
            trace_id, fields=fields, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #bd24649dac16a058 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/unstable/evaluation_rules/client.py:237

        _response = self._raw_client.get(
            evaluation_rule_id, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #613751f2b100140a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/unstable/evaluation_rules/client.py:632

        _response = await self._raw_client.get(
            evaluation_rule_id, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5b78265271f34b83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/unstable/evaluators/client.py:212

        _response = self._raw_client.get(evaluator_id, request_options=request_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #b12981abbfb5ed52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/api/unstable/evaluators/client.py:483

        _response = await self._raw_client.get(
            evaluator_id, request_options=request_options
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f2a840a2a0dd561d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/media.py:69

            httpx_client.get(self.url, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9d733c395d77167a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/media.py:71

            else httpx.get(self.url, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8679810e36c6a5d8 — Filesystem access.

pkgs/python/[email protected]/langfuse/media.py:178

            with open(file_path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #f872dbf2ac909440 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/media.py:378

                            httpx_client.get(
                                media_data.url,
                                timeout=content_fetch_timeout_seconds,
                            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #25678c7327730989 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langfuse/media.py:383

                            else httpx.get(
                                media_data.url, timeout=content_fetch_timeout_seconds
                            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #7502438de920feee — Environment-variable access.

pkgs/python/[email protected]/langfuse/openai.py:1213

    if os.environ.get(LANGFUSE_OPENAI_SKIP_RAW_RESPONSES, "False").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

lightrag-hku

python dependency

medium pii_flow dependency Excluded from app score #7e332c2197b9b7cc — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:340 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:320 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:340

            logger.debug("🔍 References Count: %s", len(references))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f08b243d6681bf2e — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:343 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:320 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:343

                logger.debug("🔍 First Reference Keys: %s", list(first_ref.keys()))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2c2b488ce4704169 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/llm/jina.py:177 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/llm/jina.py:128 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/llm/jina.py:177

        logger.debug(f"Jina embeddings generated: shape {embeddings.shape}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #85fa2edd507e4ce3 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/llm/voyageai.py:147 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/llm/voyageai.py:98 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/llm/voyageai.py:147

        logger.debug(f"VoyageAI embeddings generated: shape {embeddings.shape}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow tooling reachable #6008790c6a5d953a — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:43 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:43

            print(f"Using TIKTOKEN_CACHE_DIR from environment: {cache_dir}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow tooling reachable #376921224cb8e519 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:105 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:105

    print(f"\nCache location: {cache_dir}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow tooling reachable #d50ddd13118f83b2 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:108 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:108

    print(f"     tar -czf tiktoken_cache.tar.gz {cache_dir}")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow tooling reachable #5593c9178f461e13 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:116 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:40 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/lightrag/tools/download_cache.py:116

    print(f"     cp -r {cache_dir} ~/.tiktoken_cache/")

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 465 low-confidence finding(s)

low env_fs dependency Excluded from app score #4924cd48551f6398 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:73

        "ollama": os.getenv("LLM_BINDING_HOST", "http://localhost:11434"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1092fc10f510c34 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:74

        "lollms": os.getenv("LLM_BINDING_HOST", "http://localhost:9600"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #931073bddf2b0166 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:75

        "azure_openai": os.getenv("AZURE_OPENAI_ENDPOINT", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53d10778e5dfcd70 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:76

        "openai": os.getenv("LLM_BINDING_HOST", "https://api.openai.com/v1"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d9ae1d26512bf34 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:79

        "bedrock": os.getenv("LLM_BINDING_HOST", "DEFAULT_BEDROCK_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0236a2e345b8cdd4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:82

        "gemini": os.getenv("LLM_BINDING_HOST", "DEFAULT_GEMINI_ENDPOINT"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6b02e4362042165 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:85

        binding_type, os.getenv("LLM_BINDING_HOST", "http://localhost:11434")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f74434920617dd7d — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:143

    if env_key not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f83d6ea835afb34e — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:146

    value = os.environ[env_key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0d657e3d7e524f2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:176

    bearer_token = os.getenv("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd194ae81598f7e5 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/config.py:733

    args.embedding_asymmetric_configured = "EMBEDDING_ASYMMETRIC" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c490d53b50f28053 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/gunicorn_config.py:14

log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d65dcb7930f283ad — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/gunicorn_config.py:40

errorlog = os.getenv("ERROR_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe8c7eb5e3c935cc — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/gunicorn_config.py:41

accesslog = os.getenv("ACCESS_LOG", log_file_path)  # Default write to lightrag.log

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb3d6e35eed4dcbd — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:81

webui_title = os.getenv("WEBUI_TITLE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4ef2026cba26e26 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:82

webui_description = os.getenv("WEBUI_DESCRIPTION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3c1feb68dabc8aa — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:490

    api_mode_raw = os.getenv("MINERU_API_MODE", "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25b0f32489afea40 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:494

        endpoint = os.getenv("MINERU_OFFICIAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #34f336c2342a70f7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:496

        endpoint = os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c01a1f6ec36e1c8c — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:523

    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f9be4efe1958c16 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:531

            "ocr_engine": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97ab47a219713c52 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:532

            "ocr_lang": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cab4937081c6e7fa — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1262

    api_key = os.getenv("LIGHTRAG_API_KEY") or args.key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7dc2cd650383141 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1289

            if "LIGHTRAG_GUNICORN_MODE" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f38cd64d5f434cca — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1513

                api_key=os.getenv("AZURE_OPENAI_API_KEY", args.llm_binding_api_key),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #875438e46f96762f — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1514

                api_version=os.getenv("AZURE_OPENAI_API_VERSION", "2024-08-01-preview"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77c18db8e8e8b065 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1828

                        api_key=role_apikey or os.getenv("AZURE_OPENAI_API_KEY"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80fcb2420809b0b7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1829

                        api_version=os.getenv(
                            "AZURE_OPENAI_API_VERSION", "2024-08-01-preview"
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #555cc1964bc999ae — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1993

                    os.getenv("RERANK_ENABLE_CHUNKING", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6719e81ec6e81dd1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:1996

                    os.getenv("RERANK_MAX_TOKENS_PER_DOC", "4096")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1bdf31a35181ce21 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2364

                if os.environ.get("LIGHTRAG_GUNICORN_MODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe31292c037b953d — Filesystem access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2459

                content = Path(response.path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a95c37307bcd04f9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2529

    log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e915faed8998421d — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/lightrag_server.py:2634

    if "GUNICORN_CMD_ARGS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd857b4c7529a7fa — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:13

_PROCESS_START_OBJC_FORK_SAFETY = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #244eca41cdf7586c — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:76

    os.environ["LIGHTRAG_GUNICORN_MODE"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7bea6dca0648479 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:88

        current_objc_fork_safety = os.environ.get("OBJC_DISABLE_INITIALIZE_FORK_SAFETY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c8db6462a0421c06 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:206

                else os.getenv("HOST", "0.0.0.0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1048b7f77b2471b6 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:219

                else os.getenv("LOG_LEVEL", "info")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a3e8553df31a253 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:235

            if global_args.ssl or os.getenv("SSL", "").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9cfbdf050a0a43b — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:245

                    else os.getenv("SSL_CERTFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a96d216d0dbd68c6 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:250

                    else os.getenv("SSL_KEYFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4764fa1a39f6e700 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/run_with_gunicorn.py:284

        os.environ["LIGHTRAG_MAIN_PROCESS"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e936d1936648c15 — Filesystem access.

pkgs/python/[email protected]/lightrag/api/runtime_validation.py:36

            return Path(candidate).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d4e6c5f830b3a26 — Environment-variable access.

pkgs/python/[email protected]/lightrag/api/runtime_validation.py:47

    environ = environ or os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78cb24212bc9b50b — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:41

        self._lightrag_name = name or os.getenv(
            "OLLAMA_EMULATING_MODEL_NAME", DEFAULT_OLLAMA_MODEL_NAME
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #871e067caa3d8b61 — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:44

        self._lightrag_tag = tag or os.getenv(
            "OLLAMA_EMULATING_MODEL_TAG", DEFAULT_OLLAMA_MODEL_TAG
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9a358f394025a17 — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:107

    top_k: int = int(os.getenv("TOP_K", str(DEFAULT_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b0e028577de4365 — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:110

    chunk_top_k: int = int(os.getenv("CHUNK_TOP_K", str(DEFAULT_CHUNK_TOP_K)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec8ebcf864961882 — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:116

        os.getenv("MAX_ENTITY_TOKENS", str(DEFAULT_MAX_ENTITY_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e359ac8b92adf4c — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:121

        os.getenv("MAX_RELATION_TOKENS", str(DEFAULT_MAX_RELATION_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdb7d47034490a7e — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:126

        os.getenv("MAX_TOTAL_TOKENS", str(DEFAULT_MAX_TOTAL_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35f7bb432a589179 — Environment-variable access.

pkgs/python/[email protected]/lightrag/base.py:148

    enable_rerank: bool = os.getenv("RERANK_BY_DEFAULT", "true").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d8d5dc43b47fb7e — Environment-variable access.

pkgs/python/[email protected]/lightrag/chunker/paragraph_semantic.py:217

    raw = os.getenv("CHUNK_P_REFERENCES_TAIL_N")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a5e148b6c6203d1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/chunker/paragraph_semantic.py:238

    raw = os.getenv("CHUNK_P_REFERENCES_HEADINGS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89bf4284ff859bd8 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:147

        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #269076669380a6b4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:147

        eval_llm_api_key = os.getenv("EVAL_LLM_BINDING_API_KEY") or os.getenv(
            "OPENAI_API_KEY"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4718cfabfac87fd6 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:157

        eval_model = os.getenv("EVAL_LLM_MODEL", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ae26fd67d582806 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:158

        eval_llm_base_url = os.getenv("EVAL_LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0bf1de714ef001bf — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:163

            os.getenv("EVAL_EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2d1c14376f5f28a — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:164

            or os.getenv("EVAL_LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da9572a75d0f21fd — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:165

            or os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f201d5dd59fb3a18 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:167

        eval_embedding_model = os.getenv(
            "EVAL_EMBEDDING_MODEL", "text-embedding-3-large"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #213da7ca4c9c1d1b — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:171

        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19780e7ce710402e — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:171

        eval_embedding_base_url = os.getenv("EVAL_EMBEDDING_BINDING_HOST") or os.getenv(
            "EVAL_LLM_BINDING_HOST"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b660e2daa264906 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:179

            "max_retries": int(os.getenv("EVAL_LLM_MAX_RETRIES", "5")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69dd3b0bb515ac37 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:180

            "request_timeout": int(os.getenv("EVAL_LLM_TIMEOUT", "180")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a7e5b6fbc7cd6ee2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:218

            rag_api_url = os.getenv("LIGHTRAG_API_URL", "http://localhost:9621")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a7720c571e9cc71e — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:269

        query_top_k = int(os.getenv("EVAL_QUERY_TOP_K", "10"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4d17779307121ad — Filesystem access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:285

        with open(self.test_dataset_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #556481f8ea8d951a — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:316

                "top_k": int(os.getenv("EVAL_QUERY_TOP_K", "10")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bb06c8f9f20e88e — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:320

            api_key = os.getenv("LIGHTRAG_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #628cb64bfa913183 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:328

            response = await client.post(
                f"{self.rag_api_url}/query",
                json=payload,
                headers=headers if headers else None,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #25fd3e35de8de801 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:554

                        await position_pool.put(position)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #a80a7f78645f6cc7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:564

        max_async = int(os.getenv("EVAL_MAX_CONCURRENT", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #d050a38640ed5ae0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:584

            await position_pool.put(i)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #be90bf34f388543a — Filesystem access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:647

        with open(csv_path, "w", newline="", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb74035430ee8147 — Filesystem access.

pkgs/python/[email protected]/lightrag/evaluation/eval_rag_quality.py:899

        with open(json_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed65c78c0b79e230 — Filesystem access.

pkgs/python/[email protected]/lightrag/evaluation/offline_retrieval_check.py:84

    payload = json.loads(dataset_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27d62d30efe2760a — Filesystem access.

pkgs/python/[email protected]/lightrag/evaluation/offline_retrieval_check.py:92

    payload = json.loads(oracle_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5533d88c0c2b4d6 — Filesystem access.

pkgs/python/[email protected]/lightrag/evaluation/offline_retrieval_check.py:115

                tokens=Counter(tokenize(path.read_text(encoding="utf-8"))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #102058f6f77ab7ed — Filesystem access.

pkgs/python/[email protected]/lightrag/kg/faiss_impl.py:820

            with open(tmp, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c9a694504acfde2 — Filesystem access.

pkgs/python/[email protected]/lightrag/kg/faiss_impl.py:853

            with open(self._meta_file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf5e708d9a22d6c7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:27

MAX_GRAPH_NODES = int(os.getenv("MAX_GRAPH_NODES", 1000))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae328b07cf68b01c — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:38

        memgraph_workspace = os.environ.get("MEMGRAPH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8b461880d728947 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:78

            URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfaea68c34912c63 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:78

            URI = os.environ.get(
                "MEMGRAPH_URI",
                config.get("memgraph", "uri", fallback="bolt://localhost:7687"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5620151af4e6e595 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:82

            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14b909f3c4ea032c — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:82

            USERNAME = os.environ.get(
                "MEMGRAPH_USERNAME", config.get("memgraph", "username", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9db705fe1c2e8b60 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:85

            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58e530525f238614 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:85

            PASSWORD = os.environ.get(
                "MEMGRAPH_PASSWORD", config.get("memgraph", "password", fallback="")
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf36435ab0dfd092 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:88

            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79045ecbd1da860e — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/memgraph_impl.py:88

            DATABASE = os.environ.get(
                "MEMGRAPH_DATABASE",
                config.get("memgraph", "database", fallback="memgraph"),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93603b4d8bb2414a — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:159

    val = os.environ.get(key, "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8160c2f538719366 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:169

    val = os.environ.get(key, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #245551bda3f0ffd7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:212

            self.index_type or os.environ.get("MILVUS_INDEX_TYPE", "AUTOINDEX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f16b3585e13e4d5 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:217

            self.metric_type or os.environ.get("MILVUS_METRIC_TYPE", "COSINE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce774f17f18c62ca — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:231

            self.sq_type = os.environ.get("MILVUS_HNSW_SQ_TYPE", "SQ8").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #01ac0321ee695159 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:235

            self.sq_refine_type = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72dc1854e59962a4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:235

            self.sq_refine_type = os.environ.get(
                "MILVUS_HNSW_SQ_REFINE_TYPE", "FP32"
            ).upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c1a29a62b41e196 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:442

            "uri": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82a00618bf70d725 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:442

            "uri": os.environ.get(
                "MILVUS_URI",
                config.get(
                    "milvus",
                    "uri",
                    fallback=os.path.join(
                        self.global_config["working_dir"], "milvus_lite.db"
                    ),
                ),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ae0a52570a187e1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:452

            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2433d1ef0b429030 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:452

            "user": os.environ.get(
                "MILVUS_USER", config.get("milvus", "user", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1afcb9f99b636eeb — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:455

            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0319a3c591049d58 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:455

            "password": os.environ.get(
                "MILVUS_PASSWORD",
                config.get("milvus", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37d6d4b31f95a6e5 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:459

            "token": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff0341c2ee74f12d — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:459

            "token": os.environ.get(
                "MILVUS_TOKEN", config.get("milvus", "token", fallback=None)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18939aff102b490f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:464

        db_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6621b3046c67ce09 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:464

        db_name = os.environ.get(
            "MILVUS_DB_NAME",
            config.get("milvus", "db_name", fallback=None),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f971a404d774105 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2092

        milvus_workspace = os.environ.get("MILVUS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3882786a13296355 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2144

            os.getenv(
                "MILVUS_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_MILVUS_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f27ccb86da47f57d — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2150

            os.getenv(
                "MILVUS_UPSERT_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_UPSERT_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cec26336eff6b1a9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2156

            os.getenv(
                "MILVUS_DELETE_MAX_RECORDS_PER_BATCH",
                str(DEFAULT_MILVUS_DELETE_MAX_RECORDS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a07f98443fe6f2e8 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2183

            os.getenv(
                "MILVUS_MIGRATION_RETRY_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afab49659b5773f9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2189

            os.getenv(
                "MILVUS_MIGRATION_RETRY_MAX_BACKOFF",
                str(DEFAULT_MILVUS_MIGRATION_RETRY_MAX_BACKOFF_SECONDS),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27b95d9e6ae85517 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/milvus_impl.py:2211

                os.getenv(
                    "MILVUS_MIGRATION_BATCH_SLEEP",
                    str(DEFAULT_MILVUS_MIGRATION_BATCH_SLEEP_SECONDS),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b240f18c12c9a798 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:52

GRAPH_BFS_MODE = os.getenv("MONGO_GRAPH_BFS_MODE", "bidirectional")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b43db65a49dd9136 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:190

        os.getenv(
            "MONGO_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_MONGO_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3479b9f539b04ed2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:196

        os.getenv(
            "MONGO_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e6a59163cad39d4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:221

        os.getenv(
            "MONGO_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_MONGO_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b7e7cce82005a81 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:287

                uri = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed30f6570f7c4190 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:287

                uri = os.environ.get(
                    "MONGO_URI",
                    config.get(
                        "mongodb",
                        "uri",
                        fallback="mongodb://root:root@localhost:27017/",
                    ),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1d69fbe7071c828 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:295

                database_name = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06e35a0542c6f6c4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:295

                database_name = os.environ.get(
                    "MONGO_DATABASE",
                    config.get("mongodb", "database", fallback="LightRAG"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #191f39cc51795d08 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:343

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd67de70fd4fa660 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:592

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97ac75d96f12edb9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:1106

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccca67da947f354f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/mongo_impl.py:2886

        mongodb_workspace = os.environ.get("MONGODB_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #cfb2e77c74e2ef70 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/kg/nano_vector_db_impl.py:539

                if self._client.get([entity_id]):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4d9a3b6e8d9ad439 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/kg/nano_vector_db_impl.py:726

        result = client.get([id])

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #94f4446fc0ceb299 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/kg/nano_vector_db_impl.py:757

            for dp in client.get(remaining):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0283229fc13a7538 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/kg/nano_vector_db_impl.py:824

            for result in client.get(remaining):

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #9fb03fa0d9415cd4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:81

        neo4j_workspace = os.environ.get("NEO4J_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6d9f74244bf61ef — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:174

            URI = os.environ.get("NEO4J_URI", config.get("neo4j", "uri", fallback=None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4e094b8d15dc1ba — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:175

            USERNAME = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4ea93048e999373 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:175

            USERNAME = os.environ.get(
                "NEO4J_USERNAME", config.get("neo4j", "username", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf482bef8f1da180 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:178

            PASSWORD = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #191798ff9621bf70 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:178

            PASSWORD = os.environ.get(
                "NEO4J_PASSWORD", config.get("neo4j", "password", fallback=None)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1400d1b98a32774 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:182

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13344a59f44df732 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:182

                os.environ.get(
                    "NEO4J_MAX_CONNECTION_POOL_SIZE",
                    config.get("neo4j", "connection_pool_size", fallback=100),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fc4ff19325f82ce — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:188

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e493cde8e7cb03f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:188

                os.environ.get(
                    "NEO4J_CONNECTION_TIMEOUT",
                    config.get("neo4j", "connection_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3b31cc6ff9ba87f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:194

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0bfe2b22179caae — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:194

                os.environ.get(
                    "NEO4J_CONNECTION_ACQUISITION_TIMEOUT",
                    config.get(
                        "neo4j", "connection_acquisition_timeout", fallback=30.0
                    ),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f68b96fa715fb39 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:202

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09b2f60c0de7b17f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:202

                os.environ.get(
                    "NEO4J_MAX_TRANSACTION_RETRY_TIME",
                    config.get("neo4j", "max_transaction_retry_time", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2fc64c82b8b4604 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:208

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8ab07a0956ae878 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:208

                os.environ.get(
                    "NEO4J_MAX_CONNECTION_LIFETIME",
                    config.get("neo4j", "max_connection_lifetime", fallback=300.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81836731a342ea3f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:214

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7cb5eb85b74b66b — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:214

                os.environ.get(
                    "NEO4J_LIVENESS_CHECK_TIMEOUT",
                    config.get("neo4j", "liveness_check_timeout", fallback=30.0),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8995595f7793581e — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:219

            KEEP_ALIVE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb1ab43ce97e5aa3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:219

            KEEP_ALIVE = os.environ.get(
                "NEO4J_KEEP_ALIVE",
                config.get("neo4j", "keep_alive", fallback="true"),
            ).lower() in ("true", "1", "yes", "on")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3e8dd3b3482b105 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:223

            DATABASE = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c24ded774981b5ca — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/neo4j_impl.py:223

            DATABASE = os.environ.get(
                "NEO4J_DATABASE", re.sub(r"[^a-zA-Z0-9-]", "-", self.namespace)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8c2d40d42b3b683 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/opensearch_impl.py:60

    return os.environ.get(key, config.get("opensearch", cfg_key, fallback=fallback))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc4edca2e6263424 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/opensearch_impl.py:524

    opensearch_workspace = os.environ.get("OPENSEARCH_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #522350e5ddc433f7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/opensearch_impl.py:1928

        env_override = os.environ.get("OPENSEARCH_USE_PPL_GRAPHLOOKUP", "").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e791f14599e423c3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:184

        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fbecec69c5b02d4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:184

        os.environ.get(
            "POSTGRES_UPSERT_MAX_PAYLOAD_BYTES",
            str(DEFAULT_PG_UPSERT_MAX_PAYLOAD_BYTES),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #528eb0ce6d819898 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:190

        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2943335c4cb5886f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:190

        os.environ.get(
            "POSTGRES_UPSERT_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_UPSERT_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #508c9865b2a3c662 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:196

        os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efd5eb2721c0329d — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:196

        os.environ.get(
            "POSTGRES_DELETE_MAX_RECORDS_PER_BATCH",
            str(DEFAULT_PG_DELETE_MAX_RECORDS_PER_BATCH),
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7ab17d8ed1c8214 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2314

            "host": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a9f770adc9b2e49 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2314

            "host": os.environ.get(
                "POSTGRES_HOST",
                config.get("postgres", "host", fallback="localhost"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbed92ce6c59f89f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2318

            "port": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6501a9f30d402ac5 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2318

            "port": os.environ.get(
                "POSTGRES_PORT", config.get("postgres", "port", fallback=5432)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c1ce0e6d98bf3f9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2321

            "user": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9ba479daecb883f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2321

            "user": os.environ.get(
                "POSTGRES_USER", config.get("postgres", "user", fallback="postgres")
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1f1261eb3d17bff — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2324

            "password": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b170d67d1e595f6f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2324

            "password": os.environ.get(
                "POSTGRES_PASSWORD",
                config.get("postgres", "password", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7c26e21ba162b9d — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2328

            "database": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52c86e3700f3206a — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2328

            "database": os.environ.get(
                "POSTGRES_DATABASE",
                config.get("postgres", "database", fallback="postgres"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30ea45c7004338a1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2332

            "workspace": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #115d9afd8988d8b8 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2332

            "workspace": os.environ.get(
                "POSTGRES_WORKSPACE",
                config.get("postgres", "workspace", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc4750a84229cd25 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2336

            "max_connections": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9d2ebf7e233c910 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2336

            "max_connections": os.environ.get(
                "POSTGRES_MAX_CONNECTIONS",
                config.get("postgres", "max_connections", fallback=50),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df98006484cf5336 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2341

            "ssl_mode": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6baa0d1e6f07e123 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2341

            "ssl_mode": os.environ.get(
                "POSTGRES_SSL_MODE",
                config.get("postgres", "ssl_mode", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3654c46276969e1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2345

            "ssl_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df910c1c7a5efb82 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2345

            "ssl_cert": os.environ.get(
                "POSTGRES_SSL_CERT",
                config.get("postgres", "ssl_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #816516342f140b5e — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2349

            "ssl_key": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9e6cafc624d79a7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2349

            "ssl_key": os.environ.get(
                "POSTGRES_SSL_KEY",
                config.get("postgres", "ssl_key", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a772392784fc292d — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2353

            "ssl_root_cert": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f71133a0e50d36e9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2353

            "ssl_root_cert": os.environ.get(
                "POSTGRES_SSL_ROOT_CERT",
                config.get("postgres", "ssl_root_cert", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d438137a93307dd2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2357

            "ssl_crl": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9dc614fd5ea0897 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2357

            "ssl_crl": os.environ.get(
                "POSTGRES_SSL_CRL",
                config.get("postgres", "ssl_crl", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0172e2b3297073a — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2366

            "vector_index_type": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #390b6d5da9e33cef — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2366

            "vector_index_type": os.environ.get(
                "POSTGRES_VECTOR_INDEX_TYPE",
                config.get("postgres", "vector_index_type", fallback="HNSW"),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e66faed5b2f10b6 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2371

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73a920507d81a78c — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2371

                os.environ.get(
                    "POSTGRES_HNSW_M",
                    config.get("postgres", "hnsw_m", fallback="16"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd430c90a56f8eed — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2377

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e04939e5dc86e80 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2377

                os.environ.get(
                    "POSTGRES_HNSW_EF",
                    config.get("postgres", "hnsw_ef", fallback="64"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da27a403f8290d24 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2383

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24662b1b797122c3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2383

                os.environ.get(
                    "POSTGRES_IVFFLAT_LISTS",
                    config.get("postgres", "ivfflat_lists", fallback="100"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c4bd48e52a6707f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2388

            "vchordrq_build_options": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55f86102cf57f470 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2388

            "vchordrq_build_options": os.environ.get(
                "POSTGRES_VCHORDRQ_BUILD_OPTIONS",
                config.get("postgres", "vchordrq_build_options", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d0f83c5bf277947 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2392

            "vchordrq_probes": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69383d96c67fbcc5 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2392

            "vchordrq_probes": os.environ.get(
                "POSTGRES_VCHORDRQ_PROBES",
                config.get("postgres", "vchordrq_probes", fallback=""),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45c5f4c7d8a117d2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2397

                os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fad11251a812867f — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2397

                os.environ.get(
                    "POSTGRES_VCHORDRQ_EPSILON",
                    config.get("postgres", "vchordrq_epsilon", fallback="1.9"),
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a654f5e5b1b10f33 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2403

            "server_settings": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b6a4ab20b29d22a — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2403

            "server_settings": os.environ.get(
                "POSTGRES_SERVER_SETTINGS",
                config.get("postgres", "server_options", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe597d375ac64be2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2407

            "statement_cache_size": os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #440d6263dea42f69 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2407

            "statement_cache_size": os.environ.get(
                "POSTGRES_STATEMENT_CACHE_SIZE",
                config.get("postgres", "statement_cache_size", fallback=None),
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f90e705b6c202828 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2415

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd281c50c4d55427 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2415

                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRIES",
                        config.get("postgres", "connection_retries", fallback=10),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0461606b2fe6952c — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2424

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31249e5d0fabaf4e — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2424

                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF",
                        config.get(
                            "postgres", "connection_retry_backoff", fallback=3.0
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5d4f50e4c96c246 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2435

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d4786a31916d6ee — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2435

                    os.environ.get(
                        "POSTGRES_CONNECTION_RETRY_BACKOFF_MAX",
                        config.get(
                            "postgres",
                            "connection_retry_backoff_max",
                            fallback=30.0,
                        ),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5caa9cd8d7fc1a8 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2448

                    os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43438f43f338c2e7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/postgres_impl.py:2448

                    os.environ.get(
                        "POSTGRES_POOL_CLOSE_TIMEOUT",
                        config.get("postgres", "pool_close_timeout", fallback=5.0),
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63d83d5da43e617b — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:475

        qdrant_workspace = os.environ.get("QDRANT_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cee0134232380e5e — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:520

            os.getenv(
                "QDRANT_UPSERT_MAX_PAYLOAD_BYTES",
                str(DEFAULT_QDRANT_UPSERT_MAX_PAYLOAD_BYTES),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b04d4a05eb235331 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:526

            os.getenv(
                "QDRANT_UPSERT_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_UPSERT_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2172216262cc0bd — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:532

            os.getenv(
                "QDRANT_DELETE_MAX_POINTS_PER_BATCH",
                str(DEFAULT_QDRANT_DELETE_MAX_POINTS_PER_BATCH),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b58ee498bfaef97d — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:657

                        url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2da73dd3a24ca88 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:657

                        url=os.environ.get(
                            "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfb7082e0e8b24d3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:660

                        api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f0abb3c46dbbe38 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/qdrant_impl.py:660

                        api_key=os.environ.get(
                            "QDRANT_API_KEY",
                            config.get("qdrant", "apikey", fallback=None),
                        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4278fc3d6a2dd3f7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:45

MAX_CONNECTIONS = int(os.getenv("REDIS_MAX_CONNECTIONS", "200"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #206dadf8448b226d — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:46

SOCKET_TIMEOUT = float(os.getenv("REDIS_SOCKET_TIMEOUT", "30.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f9cb96010bc8f03 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:47

SOCKET_CONNECT_TIMEOUT = float(os.getenv("REDIS_CONNECT_TIMEOUT", "10.0"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9449304e760d127 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:48

RETRY_ATTEMPTS = int(os.getenv("REDIS_RETRY_ATTEMPTS", "3"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68786690e6ef6987 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:137

        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55ad9266cae92979 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:165

        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2be0fc32abb091ab — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:165

        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07365e4f76d7fca4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:534

        redis_workspace = os.environ.get("REDIS_WORKSPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef6b60d12a059556 — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:564

        self._redis_url = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c16ac9b93108f51b — Environment-variable access.

pkgs/python/[email protected]/lightrag/kg/redis_impl.py:564

        self._redis_url = os.environ.get(
            "REDIS_URI", config.get("redis", "uri", fallback="redis://localhost:6379")
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #319d06b818e3e2e7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:290

    workspace: str = field(default_factory=lambda: os.getenv("WORKSPACE", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2348afefc2442e10 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:484

    embedding_batch_num: int = field(default=int(os.getenv("EMBEDDING_BATCH_NUM", 10)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #294f70a86a814e36 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:488

        default=int(os.getenv("EMBEDDING_FUNC_MAX_ASYNC", 8))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91135ad0bb031e15 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:506

        default=int(os.getenv("EMBEDDING_TIMEOUT", DEFAULT_EMBEDDING_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a689fa5189100f51 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:530

        default=int(os.getenv("SUMMARY_MAX_TOKENS", DEFAULT_SUMMARY_MAX_TOKENS))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db38a8ca36e4a6ef — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:535

        default=int(os.getenv("SUMMARY_CONTEXT_SIZE", DEFAULT_SUMMARY_CONTEXT_SIZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68b0f4554ad3f59a — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:541

            os.getenv("SUMMARY_LENGTH_RECOMMENDED", DEFAULT_SUMMARY_LENGTH_RECOMMENDED)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6dad56475eb41bfe — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:548

            os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e897c0d6cdf6746a — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:557

        default=int(os.getenv("LLM_TIMEOUT", DEFAULT_LLM_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d82df911ac92b1d3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:561

        default=os.getenv("ENTITY_EXTRACTION_USE_JSON", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eda798b5ad1edf74 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:577

            os.getenv(
                "MAX_ASYNC_RERANK",
                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #623ddee1b7974650 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:579

                os.getenv("MAX_ASYNC_LLM", os.getenv("MAX_ASYNC", DEFAULT_MAX_ASYNC)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3760c33dce6fcfa — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:588

        default=int(os.getenv("RERANK_TIMEOUT", DEFAULT_RERANK_TIMEOUT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c899531fe9c1957 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:625

        default=int(os.getenv("MAX_PARALLEL_INSERT", DEFAULT_MAX_PARALLEL_INSERT))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68ca4a6f40a9aa92 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:631

            os.getenv(
                "MAX_PARALLEL_PARSE_NATIVE", str(DEFAULT_MAX_PARALLEL_PARSE_NATIVE)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a0ea4bd442b553a — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:638

            os.getenv(
                "MAX_PARALLEL_PARSE_MINERU", str(DEFAULT_MAX_PARALLEL_PARSE_MINERU)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ac21ef81a56d747 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:645

            os.getenv(
                "MAX_PARALLEL_PARSE_DOCLING", str(DEFAULT_MAX_PARALLEL_PARSE_DOCLING)
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2dc9ef7bf4d86bb — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:652

            os.getenv("MAX_PARALLEL_ANALYZE", str(DEFAULT_MAX_PARALLEL_ANALYZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d7ebbbb1a83a605 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:656

        default=int(os.getenv("QUEUE_SIZE_PARSE", str(DEFAULT_QUEUE_SIZE_PARSE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #daf4a0b28c5963db — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:659

        default=int(os.getenv("QUEUE_SIZE_ANALYZE", str(DEFAULT_QUEUE_SIZE_ANALYZE)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f10d31010125eb70 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:662

        default=int(os.getenv("QUEUE_SIZE_INSERT", str(DEFAULT_QUEUE_SIZE_INSERT)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f8d860a1023def0 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:736

        default=float(os.getenv("COSINE_THRESHOLD", 0.2))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39aeff4703324bde — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:818

                chunker_cfg["chunk_token_size"] = int(os.getenv("CHUNK_SIZE", 1200))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #094e9921ab8c3479 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:826

            legacy_overlap_default = int(os.getenv("CHUNK_OVERLAP_SIZE", 100))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1ce98886b0468cf — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:855

        p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf082da1b9f34c52 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:877

            size_raw = os.getenv(size_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6168885307caef20 — Environment-variable access.

pkgs/python/[email protected]/lightrag/lightrag.py:969

        if os.getenv("ENTITY_TYPES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9576a17536d8d32f — Filesystem access.

pkgs/python/[email protected]/lightrag/llm/_vision_utils.py:273

        with open(path, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42752324f306cf84 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/anthropic.py:78

        api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17975fbef84c4be0 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/binding_options.py:379

            env_raw = os.getenv(role_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7918f55d63c4b94 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/binding_options.py:806

        os.environ["OPENAI_LLM_REASONING"] = (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fc08c443b09e708 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/binding_options.py:829

            if "OPENAI_LLM_REASONING" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9d45d3f891c5dbe — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/binding_options.py:830

                del os.environ["OPENAI_LLM_REASONING"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #f29f3da8cd6da764 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/llm/deprecated/siliconcloud.py:57

        async with session.post(base_url, headers=headers, json=payload) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #d9f56fefbe6598dc — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/gemini.py:98

    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93888b79f01b8510 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/gemini.py:102

        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b606e23280257cb — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/gemini.py:104

            location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d9511effd961c5b — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/gemini.py:134

    use_vertexai = os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d2d4b2156f4063b — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/gemini.py:139

    key = api_key or os.getenv("LLM_BINDING_API_KEY") or os.getenv("GEMINI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef93c1d96b39a548 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/hf.py:32

os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #09085d7ff0d2ecea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/llm/jina.py:24

        async with session.post(url, headers=headers, json=data) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #f2192457fab2f1d9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/jina.py:120

        os.environ["JINA_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2be94888d249dc1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/jina.py:122

    if "JINA_API_KEY" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c52e2aa5184427bb — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/jina.py:128

        "Authorization": f"Bearer {os.environ['JINA_API_KEY']}",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #90fb2ab0e68e33da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/llm/lollms.py:133

                async with session.post(
                    f"{base_url}/lollms_generate", json=request_data
                ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7733a068e0618ae4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/llm/lollms.py:141

            async with session.post(
                f"{base_url}/lollms_generate", json=request_data
            ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #27fcb935f986026b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/llm/lollms.py:205

            async with session.post(
                f"{base_url}/lollms_embed",
                json=request_data,
            ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #16bec28847a1d4db — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/nvidia_openai.py:57

        os.environ["OPENAI_API_KEY"] = api_key

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #721cf6803a7975cb — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/ollama.py:147

        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59be99fe282384c2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/ollama.py:299

        api_key = os.getenv("OLLAMA_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30038566deec39c4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:48

    langfuse_public_key = os.environ.get("LANGFUSE_PUBLIC_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98f7db746cffdc70 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:49

    langfuse_secret_key = os.environ.get("LANGFUSE_SECRET_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0be9e436dca704e2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:110

EMBEDDING_USE_BASE64: bool = os.getenv("EMBEDDING_USE_BASE64", "true").lower() in (

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f086922311327533 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:166

            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5fa3921d7467974 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:166

            api_key = os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get(
                "LLM_BINDING_API_KEY"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2900ac3bfae2b8b7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:192

            api_key = os.environ["OPENAI_API_KEY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #198f80c18de02af2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:198

        dashscope_workspace_id = os.getenv("DASHSCOPE_WORKSPACE_ID", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b83cfa928056d426 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:215

            merged_configs["base_url"] = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c77df0b3ce64d0db — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:215

            merged_configs["base_url"] = os.environ.get(
                "OPENAI_API_BASE", "https://api.openai.com/v1"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8653b41ab9f3076 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1070

    deployment = os.getenv("AZURE_OPENAI_DEPLOYMENT") or model or os.getenv("LLM_MODEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ffd3a2a691b4198 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1072

        base_url or os.getenv("AZURE_OPENAI_ENDPOINT") or os.getenv("LLM_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9499b49e8c90d773 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1075

        api_key or os.getenv("AZURE_OPENAI_API_KEY") or os.getenv("LLM_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #816a33c9049bc33b — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1079

        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f16c9ff0e196d3f9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1080

        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1999bfb26d282fd3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1120

        os.getenv("LLM_MODEL", "gpt-4o-mini"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32da9dcc46a4399a — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1189

        os.getenv("AZURE_EMBEDDING_DEPLOYMENT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29ea8d3197be0f88 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1191

        or os.getenv("EMBEDDING_MODEL", "text-embedding-3-small")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #202f4fd6e4c678fa — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1195

        or os.getenv("AZURE_EMBEDDING_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f49243107f46ab6 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1196

        or os.getenv("EMBEDDING_BINDING_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #968ad3d6f5b0f3fa — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1200

        or os.getenv("AZURE_EMBEDDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd8b90eb7ebfa999 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1201

        or os.getenv("EMBEDDING_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bc3f92a5a877715 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1205

        or os.getenv("AZURE_EMBEDDING_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b5a77c0cb514b3c — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1206

        or os.getenv("AZURE_OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #49a13c7bd828ce37 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/openai.py:1207

        or os.getenv("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ea4c7d636fa8274 — Environment-variable access.

pkgs/python/[email protected]/lightrag/llm/voyageai.py:98

        api_key = os.environ.get("VOYAGE_API_KEY") or os.environ.get("VOYAGEAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b95780d4e29df3a — Environment-variable access.

pkgs/python/[email protected]/lightrag/multimodal_context.py:697

    raw = os.getenv("CHUNK_R_SEPARATORS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d1ec63723d21a4d3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/multimodal_context.py:762

        raw = os.getenv(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f6fb4a179009772 — Filesystem access.

pkgs/python/[email protected]/lightrag/multimodal_context.py:952

            payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89697459c85e99f0 — Filesystem access.

pkgs/python/[email protected]/lightrag/multimodal_context.py:997

            sidecar_path.write_text(
                json.dumps(payload, ensure_ascii=False, indent=2),
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0d253598cc7751e — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/docx/parse_document.py:113

        with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03b3769b82cded1f — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:90

    return os.getenv("GOOGLE_GENAI_USE_VERTEXAI", "").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe86643c769003fb — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:121

        project = os.getenv("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d56dfbbdcdcb61ba — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:122

        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c097c2864cf5f2c9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:123

        base_url = os.getenv("GOOGLE_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c65b86a95cfb03e6 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:143

        api_key = os.getenv("GOOGLE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2dc872cf4f88227b — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:164

        project = os.getenv("GOOGLE_CLOUD_PROJECT", "unknown")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fe5e45144e4f4f0 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:165

        location = os.getenv("GOOGLE_CLOUD_LOCATION", "us-central1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f300b171752e8f88 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:189

    api_key = os.getenv("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #440d0b9daa109789 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:193

    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8a1a01b7213570d — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/docx/utils.py:207

    base_url = os.getenv("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5ea73e904e6f31b — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/_common.py:70

    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75f4f8c4a6c9e44c — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/_common.py:79

    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52fc032530de0917 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/_common.py:93

    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #774b171ad68ec3cb — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/external/_manifest.py:132

        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd017329f2d263d6 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/external/_manifest.py:152

    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fde80380e9c61354 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:84

    endpoint = os.getenv("DOCLING_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08037f148cbed4ab — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:138

        "DOCLING_OCR_ENGINE": os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ffc0638dd195563 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:139

        "DOCLING_OCR_PRESET": os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77c73b4833d91af6 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:140

        "DOCLING_OCR_LANG": os.getenv("DOCLING_OCR_LANG", "").strip(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20b8e04f52776489 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/cache.py:177

    cur_engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3ee627225ff47ea — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:97

        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5617b9ba88428633 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:105

        self.ocr_engine = os.getenv("DOCLING_OCR_ENGINE", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #413fb0114c642d98 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:106

        self.ocr_preset = os.getenv("DOCLING_OCR_PRESET", "auto").strip() or "auto"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1840397a10b48887 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:107

        self.ocr_lang_raw = os.getenv("DOCLING_OCR_LANG", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #d02499386cd76c67 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:229

            resp = await client.post(
                url, data=self._build_multipart_data(), files=files
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5cc9066fec7f9a64 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:248

            resp = await client.get(url, params=params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d15d807df8555539 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/docling/client.py:286

        resp = await client.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #44e85810ce0301cb — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/docling/ir_builder.py:81

        self.engine_version = os.getenv("DOCLING_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9235404488e53a3 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/external/docling/ir_builder.py:109

            doc = json.loads(main_json.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fe12380fe9d8525 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:109

    mode = _normalize_api_mode(os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27c6c95c716a7f07 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:119

    raw = os.getenv(name, "").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb7e23ded694bc0d — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:128

    raw = os.getenv(name, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d89e0ec636aa448c — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:144

            os.getenv("MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79fd20eeeb53c650 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:149

        return os.getenv("MINERU_LOCAL_ENDPOINT", "").strip().rstrip("/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44e471dcb674fcdd — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:220

            overrides.get("page_range", os.getenv("MINERU_PAGE_RANGES", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb0139d24e1a19fd — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:225

                    "language", os.getenv("MINERU_LANGUAGE", DEFAULT_MINERU_LANGUAGE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f3c69c69137f987 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:234

                    os.getenv(
                        "MINERU_LOCAL_PARSE_METHOD", DEFAULT_MINERU_LOCAL_PARSE_METHOD
                    ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d4fadb805bcc701 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:252

                os.getenv("MINERU_MODEL_VERSION", DEFAULT_MINERU_MODEL_VERSION).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e132371ebdceb2f1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:263

                os.getenv("MINERU_LOCAL_BACKEND", DEFAULT_MINERU_LOCAL_BACKEND).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22056c4975045749 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/cache.py:379

    cur_engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e296598493687660 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:122

            os.getenv("MINERU_API_MODE", DEFAULT_MINERU_API_MODE).strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e69f11a6c44e8bf4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:131

            os.getenv(
                "MINERU_OFFICIAL_ENDPOINT", DEFAULT_MINERU_OFFICIAL_ENDPOINT
            ).strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04ddb6de2fbd5999 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:137

            os.getenv("MINERU_LOCAL_ENDPOINT", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd0ed8b53dc1e85d — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:139

        self.api_token = os.getenv("MINERU_API_TOKEN", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df27c95e739e2d5c — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:162

        self.poll_interval = float(os.getenv("MINERU_POLL_INTERVAL_SECONDS", "2"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #210d930116f84844 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:164

        self.max_polls = int(os.getenv("MINERU_MAX_POLLS", "600"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #441dc839f2aca617 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:165

        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #81f3af64b1aea199 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:271

        resp = await client.post(
            apply_url,
            headers=self._official_headers(),
            json=self._official_payload(upload_name),
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a341a850424aa365 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:300

        upload_resp = await client.put(
            upload_url,
            content=_iter_file_bytes(source_file_path),
            headers={"Content-Length": str(source_file_path.stat().st_size)},
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3657369ed2e80765 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:320

            resp = await client.get(poll_url, headers=self._official_headers())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #51798f0faa1a9ca0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:390

            resp = await client.post(
                submit_url,
                data=self._local_form_data(),
                files=files,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #517cbd098e7b61cc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:422

            resp = await client.get(poll_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #647c81d8b73e5942 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:445

            resp = await client.get(result_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #f7d0099b28e9199e — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/client.py:673

            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #503377cff587e748 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:86

        self.engine_version = os.getenv("MINERU_ENGINE_VERSION", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42b3e217c977d5b4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:90

        self.image_url_template = os.getenv("MINERU_IMAGE_URL_TEMPLATE", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f34de625275ac58b — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:95

        raw = os.getenv("MINERU_BBOX_ATTRIBUTES", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c25573c0c19354b — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/ir_builder.py:139

        content_list = json.loads(content_list_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3206c61e77d59cc5 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/manifest.py:126

        payload = json.loads(p.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7e781ec9e807650 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/external/mineru/manifest.py:147

    tmp.write_text(
        json.dumps(manifest.to_dict(), ensure_ascii=False, indent=2),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2d10fde66e86909 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/legacy/parser.py:47

        pdf_password = os.getenv("PDF_DECRYPT_PASSWORD") or None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9162c292692ff0d1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:209

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #60051aaef6ccf432 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:216

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #633abed9cc7410c3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:228

    raw = os.getenv("NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #049e1f5a1bb45a55 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:456

        data = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #72f7dd00d4a6a420 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:511

        with opener.open(req, timeout=self._timeout) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #e92f7f1160e753ef — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:572

            md_text = source.read_bytes().decode("utf-8-sig")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f197f9467c251e94 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:583

            source.read_bytes(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46ed7716861af0dd — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/markdown/parser.py:589

        return text_file.read_bytes().decode("utf-8-sig"), text_file.parent

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7a5a57681e80c30 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:49

        "max_bytes": os.getenv("NATIVE_MD_IMAGE_MAX_BYTES", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c991f0d0f895800d — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:50

        "max_svg_pixels": os.getenv("NATIVE_MD_IMAGE_MAX_SVG_PIXELS", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37dbfd54f4c97635 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:51

        "allowed_non_public_cidrs": os.getenv(
            "NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS", ""
        ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c033291adc3c7373 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:136

            data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31e659ddc58001d6 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:194

            tmp.write_text(
                json.dumps(manifest, ensure_ascii=False, indent=2), encoding="utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #798082b1a411a968 — Filesystem access.

pkgs/python/[email protected]/lightrag/parser/markdown/raw_cache.py:214

            payload = json.loads(path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75780f0f21018579 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/param_schema.py:410

    return (os.getenv("MINERU_API_MODE", "") or "").strip().lower() != "official"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb95350ef762689c — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/registry.py:45

    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8be60b132f1e60c0 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/registry.py:47

        return bool(os.getenv("MINERU_API_TOKEN", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d974864119e6d6f — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/registry.py:49

        return bool(os.getenv("MINERU_LOCAL_ENDPOINT", "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94bfa1b9576fef56 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/registry.py:54

    mode = os.getenv("MINERU_API_MODE", "local").strip().lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae3b234c1da61219 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/registry.py:64

    return lambda: bool(os.getenv(env_name, "").strip())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30f6eabdb7bf5c00 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:317

            p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae278ca35514e150 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:328

        if os.getenv("CHUNK_P_DROP_REFERENCES") is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30c0d612d34f2b98 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:337

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1e339f8ab618510 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:347

    raw = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e27001977a34b098 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:398

                os.getenv("CHUNK_R_SEPARATORS", json.dumps(list(DEFAULT_R_SEPARATORS)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6858cd8a16570aac — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:402

            "breakpoint_threshold_type": os.getenv(
                "CHUNK_V_BREAKPOINT_THRESHOLD_TYPE", "percentile"
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48bb51ec3ef35ef8 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:406

                os.getenv("CHUNK_V_BREAKPOINT_THRESHOLD_AMOUNT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2592ba90c58651a — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:408

            "buffer_size": int(os.getenv("CHUNK_V_BUFFER_SIZE", "1")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88492264d8dd67c4 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:413

            "sentence_split_regex": os.getenv(
                "CHUNK_V_SENTENCE_SPLIT_REGEX", DEFAULT_SENTENCE_SPLIT_REGEX
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #177dfae4a2f912a9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:423

    f_overlap_raw = os.getenv("CHUNK_F_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d3f270bba8089d2 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:426

    r_overlap_raw = os.getenv("CHUNK_R_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a019cc20c2c2d277 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:429

    p_overlap_raw = os.getenv("CHUNK_P_OVERLAP_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1589ed8a1fcd001e — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:443

    p_size_raw = os.getenv("CHUNK_P_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3b52b5af170dd2f — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:454

    f_size_raw = os.getenv("CHUNK_F_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87ff4c2441099e10 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:457

    r_size_raw = os.getenv("CHUNK_R_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6314e721195c1a0 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:460

    v_size_raw = os.getenv("CHUNK_V_SIZE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3cae8e4793118b0 — Environment-variable access.

pkgs/python/[email protected]/lightrag/parser/routing.py:918

    return os.getenv("LIGHTRAG_PARSER", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab74b0c447764c5d — Filesystem access.

pkgs/python/[email protected]/lightrag/pipeline.py:3375

            lines = block_file.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31a877fd57182ab0 — Environment-variable access.

pkgs/python/[email protected]/lightrag/pipeline.py:3410

                int(os.getenv("VLM_MAX_IMAGE_BYTES", str(5 * 1024 * 1024))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c4d8915718396a1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/pipeline.py:3414

                int(os.getenv("VLM_MIN_IMAGE_PIXEL", str(DEFAULT_MM_IMAGE_MIN_PIXEL))),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93d551657f8213ff — Filesystem access.

pkgs/python/[email protected]/lightrag/pipeline.py:3654

                    raw = candidate.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f38b114d83ac61da — Filesystem access.

pkgs/python/[email protected]/lightrag/pipeline.py:4040

                    payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #995e043b5d5e9ab0 — Filesystem access.

pkgs/python/[email protected]/lightrag/pipeline.py:4168

                    sidecar_path.write_text(
                        json.dumps(payload, ensure_ascii=False, indent=2),
                        encoding="utf-8",
                    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9d33af10083297e — Filesystem access.

pkgs/python/[email protected]/lightrag/pipeline.py:4358

                payload = json.loads(sidecar_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f1fc448c2a62885 — Environment-variable access.

pkgs/python/[email protected]/lightrag/prompt.py:562

    configured = os.getenv("PROMPT_DIR", "").strip() or _DEFAULT_PROMPT_DIR

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16a271e2e3393e5f — Filesystem access.

pkgs/python/[email protected]/lightrag/prompt.py:635

        content = profile_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #8e10aa26d06c0327 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/lightrag/rerank.py:291

        async with session.post(base_url, headers=headers, json=payload) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #598138588e2537b5 — Environment-variable access.

pkgs/python/[email protected]/lightrag/rerank.py:418

        api_key = os.getenv("COHERE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9dab44cf6f9944ef — Environment-variable access.

pkgs/python/[email protected]/lightrag/rerank.py:460

        api_key = os.getenv("JINA_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d84b637a6d5efcc — Environment-variable access.

pkgs/python/[email protected]/lightrag/rerank.py:500

        api_key = os.getenv("DASHSCOPE_API_KEY") or os.getenv("RERANK_BINDING_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93fa4d991a14dd0f — Filesystem access.

pkgs/python/[email protected]/lightrag/sidecar/writer.py:330

    blocks_path.write_text(
        "\n".join([json.dumps(meta, ensure_ascii=False)] + blocks_lines) + "\n",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8d4f5eb78f0ee9d — Filesystem access.

pkgs/python/[email protected]/lightrag/sidecar/writer.py:339

        tables_path.write_text(
            json.dumps(
                {"version": "1.0", "tables": tables},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8859772f7862effd — Filesystem access.

pkgs/python/[email protected]/lightrag/sidecar/writer.py:349

        drawings_path.write_text(
            json.dumps(
                {"version": "1.0", "drawings": drawings},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fa22dfd415d815b — Filesystem access.

pkgs/python/[email protected]/lightrag/sidecar/writer.py:359

        equations_path.write_text(
            json.dumps(
                {"version": "1.0", "equations": equations},
                ensure_ascii=False,
                indent=2,
            )
            + "\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #3e48387bd6142ff1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:141

            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #01370486da708244 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:146

        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #936bb488e393b8eb — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:198

        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #3b64c1054dd27f05 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/clean_llm_query_cache.py:266

            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #6a95fae1d19c3b82 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:34

        os.environ["TIKTOKEN_CACHE_DIR"] = cache_dir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #831bd4e1092cbab1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/download_cache.py:40

        env_cache_dir = os.environ.get("TIKTOKEN_CACHE_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #2af4e36a5f326845 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:126

            specific_workspace = os.getenv(WORKSPACE_ENV_MAP[storage_name])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #59ff873f37aaa423 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:131

        workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #ca24f4b42f431104 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:183

        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #8c5700dc272e932d — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:219

                has_env = all(var in os.environ for var in required_vars)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #f0d356616bab520c — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:279

            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #7897b8c103215a7c — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1090

                    if "REDIS_URI" in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #0aa1bafff096428f — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1098

                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #fb0e959bd9f41898 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1108

                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #0484f24ccc52b1cf — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/migrate_llm_cache.py:1118

                        var in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #cceb3585fbb91f6e — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:154

                url=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #cce39a5aac52590f — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:154

                url=os.environ.get(
                    "QDRANT_URL", config.get("qdrant", "uri", fallback=None)
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #221307cac5bee889 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:157

                api_key=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #6497d89ff5f0f267 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/prepare_qdrant_legacy_data.py:157

                api_key=os.environ.get(
                    "QDRANT_API_KEY",
                    config.get("qdrant", "apikey", fallback=None),
                ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #2036dbd6b49e0fd8 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:584

            "graph": os.getenv("LIGHTRAG_GRAPH_STORAGE", "NetworkXStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #25931d2c2ec80239 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:585

            "vector": os.getenv("LIGHTRAG_VECTOR_STORAGE", "NanoVectorDBStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #9a98b4ae4dabae8a — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:586

            "kv": os.getenv("LIGHTRAG_KV_STORAGE", "JsonKVStorage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #ea8ddbab153a10f3 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:592

        missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #91d2cc3e389af38f — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:625

            "working_dir": os.getenv("WORKING_DIR", "./rag_storage"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #71a4b7dfc840319b — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:654

                    os.getenv("TIKTOKEN_MODEL_NAME", "gpt-4o-mini")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #389fcefdd1875533 — Environment-variable access.

pkgs/python/[email protected]/lightrag/tools/rebuild_vdb.py:666

        self.workspace = os.getenv("WORKSPACE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22409fd1ad17f8f9 — Environment-variable access.

pkgs/python/[email protected]/lightrag/utils.py:269

    value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b81baf8fc49de161 — Environment-variable access.

pkgs/python/[email protected]/lightrag/utils.py:315

VERBOSE_DEBUG = os.getenv("VERBOSE", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #971968a3af7bc8c7 — Environment-variable access.

pkgs/python/[email protected]/lightrag/utils.py:317

    os.getenv("LIGHTRAG_PERFORMANCE_TIMING_LOGS", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #623bc70c24be1d1b — Environment-variable access.

pkgs/python/[email protected]/lightrag/utils.py:442

            log_dir = os.getenv("LOG_DIR", os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0566a20d8602dd20 — Filesystem access.

pkgs/python/[email protected]/lightrag/utils.py:2332

    with open(file_name, encoding="utf-8-sig") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d7cae0e04d08d36 — Filesystem access.

pkgs/python/[email protected]/lightrag/utils.py:2450

            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5eba9adee8b59f83 — Filesystem access.

pkgs/python/[email protected]/lightrag/utils.py:2457

            with open(tmp_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f7628aa9bc81557 — Filesystem access.

pkgs/python/[email protected]/lightrag/utils.py:3158

        with open(output_path, "w", newline="", encoding="utf-8") as csvfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1bae7a7c08f16afb — Filesystem access.

pkgs/python/[email protected]/lightrag/utils.py:3208

        with open(output_path, "w", encoding="utf-8") as mdfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #106765cd2bfeed3e — Filesystem access.

pkgs/python/[email protected]/lightrag/utils.py:3270

        with open(output_path, "w", encoding="utf-8") as txtfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1614730781943b1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/utils.py:3982

    missing_vars = [var for var in required_vars if var not in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63e1cee2033650c1 — Environment-variable access.

pkgs/python/[email protected]/lightrag/utils_pipeline.py:541

    input_dir = os.getenv("INPUT_DIR", "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

redis

python dependency

medium telemetry dependency Excluded from app score #8698d056e1818c1d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/asyncio/observability/recorder.py:247

        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #c32ee67c9d79b442 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/metrics.py:37

    from opentelemetry.metrics import Meter

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #17cfb966e2ce8223 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/providers.py:32

    from opentelemetry.sdk.metrics import MeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #39b70dc1c87e2797 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/providers.py:76

            from opentelemetry import metrics

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #39e42a55a9615a18 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/providers.py:77

            from opentelemetry.metrics import NoOpMeterProvider

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #f1867a3f44bb3fa2 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/recorder.py:242

        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #b3084b8f9c230f5b — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/recorder.py:727

    from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry dependency Excluded from app score #e163b518359ba7a1 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.

pkgs/python/[email protected]/redis/observability/registry.py:8

        from opentelemetry.metrics import Observation

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 6 low-confidence finding(s)

low egress dependency Excluded from app score #0e3a29ddcdd0e33d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/asyncio/multidb/healthcheck.py:505

        await self._http_client.get(url, expect_json=False)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #7fb79a71ba66396a — Filesystem access.

pkgs/python/[email protected]/redis/commands/json/__init__.py:303

            with open(fp) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c2a28c5277c0363 — Filesystem access.

pkgs/python/[email protected]/redis/commands/json/commands.py:650

        with open(file_name) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #d0bf1b1af6385bbe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/http/http_client.py:309

        with urlopen(request, timeout=timeout or self.timeout, context=context) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #161852a8b6098175 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/ocsp.py:272

        r = requests.get(issuer_url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fbe9503bfeba53f1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/redis/ocsp.py:285

        r = requests.get(ocsp_url, headers=header)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

PyJWT

python dependency

expand_more 5 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #cb46be763fbed9c8 — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:11

    with open(os.path.join(here, *parts), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0548cb7ccc29a427 — Environment-variable access.

pkgs/python/[email protected]/docs/conf.py:97

os.environ["SPHINX_BUILD"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7236b48bec41f1d6 — Environment-variable access.

pkgs/python/[email protected]/jwt/algorithms.py:102

    if TYPE_CHECKING or bool(os.getenv("SPHINX_BUILD", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfde7f8bbf5672dc — Environment-variable access.

pkgs/python/[email protected]/jwt/api_jwt.py:25

if TYPE_CHECKING or bool(os.getenv("SPHINX_BUILD", "")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #185f1de72bca5191 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/jwt/jwks_client.py:118

            with urllib.request.urlopen(
                r, timeout=self.timeout, context=self.ssl_context
            ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

PyYAML

python dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #02cae8d23336fe41 — Environment-variable access.

pkgs/python/[email protected]/setup.py:72

os.environ['SETUPTOOLS_USE_DISTUTILS'] = 'local'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b84455863d84892 — Environment-variable access.

pkgs/python/[email protected]/setup.py:81

if 'sdist' in sys.argv or os.environ.get('PYYAML_FORCE_CYTHON') == '1':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf0cbffa6b9f0e09 — Environment-variable access.

pkgs/python/[email protected]/setup.py:160

            with_ext = getattr(self, ext.attr_name) or os.environ.get('PYYAML_FORCE_{0}'.format(ext.feature_name.upper()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

aioboto3

python dependency

expand_more 6 low-confidence finding(s)

low egress dependency Excluded from app score #caa8c00ae814d36b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/resources/make_pr.py:38

resp = requests.get('https://pypi.org/pypi/aiobotocore/json').json()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #db97819075d3d60e — Environment-variable access.

pkgs/python/[email protected]/resources/make_pr.py:54

g = Github(os.environ['GITHUB_TOKEN'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c117a1a57b33d2c — Filesystem access.

pkgs/python/[email protected]/resources/make_pr.py:83

with open('setup.py', 'r') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e48ae7a3c77c08c0 — Filesystem access.

pkgs/python/[email protected]/resources/make_pr.py:85

with open('setup.py', 'w') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59ff28879964ba81 — Filesystem access.

pkgs/python/[email protected]/resources/make_pr.py:92

with open('Pipfile', 'r') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55a2b8192f219752 — Filesystem access.

pkgs/python/[email protected]/resources/make_pr.py:98

with open('Pipfile', 'w') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

aiohttp

python dependency

expand_more 30 low-confidence finding(s)

low env_fs dependency Excluded from app score #56b0241e515f3965 — Filesystem access.

pkgs/python/[email protected]/aiohttp/cookiejar.py:207

        with open(
            file_path,
            mode="w",
            encoding="utf-8",
            opener=lambda path, flags: os.open(path, flags, 0o600),
        ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6d56efec413e7c8 — Environment-variable access.

pkgs/python/[email protected]/aiohttp/helpers.py:73

NO_EXTENSIONS = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #011957f5cf451067 — Environment-variable access.

pkgs/python/[email protected]/aiohttp/helpers.py:82

    not sys.flags.ignore_environment and bool(os.environ.get("PYTHONASYNCIODEBUG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbe711b94963a15e — Environment-variable access.

pkgs/python/[email protected]/aiohttp/helpers.py:228

    netrc_env = os.environ.get("NETRC")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #035dd57aa920350f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/aiohttp/test_utils.py:347

        resp = await self._session.request(method, self.make_url(path), **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #a2e4923fa02df4ac — Environment-variable access.

pkgs/python/[email protected]/aiohttp/web_fileresponse.py:50

NOSENDFILE: Final[bool] = bool(os.environ.get("AIOHTTP_NOSENDFILE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #7ce3dc45b86c61bc — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/docs/code/client_middleware_cookbook.py:65

                async with req.session.post(url, data=self.refresh_token) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #ba545ef73bef2fb2 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/docs/code/client_middleware_cookbook.py:87

                    async with req.session.post(url, data=self.refresh_token) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #e0e034d2d73af00d — Environment-variable access.

pkgs/python/[email protected]/docs/conf.py:21

    os.getenv("READTHEDOCS", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d13c76f41add1d92 — Environment-variable access.

pkgs/python/[email protected]/docs/conf.py:22

    and os.environ["READTHEDOCS_VERSION_TYPE"] == "tag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #46aa30c8a9b8d214 — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:31

with open(_version_path, encoding="latin1") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #7465f25affbe9ff5 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/client_auth.py:9

    async with session.get("http://httpbin.org/basic-auth/andrew/password") as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #31a234c9441312b8 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/client_json.py:9

    async with session.get("http://httpbin.org/get") as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #bff5fe424dbb71af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/curl.py:12

        async with session.request("GET", url) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #cc4e03817912ddbd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/digest_auth_qop_auth.py:48

            async with session.get(url) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #d2497cc07891c78c — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/fake_server.py:109

        async with session.get(
            "https://graph.facebook.com/v2.7/me", params={"access_token": token}
        ) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #1968cc7169786120 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/fake_server.py:114

        async with session.get(
            "https://graph.facebook.com/v2.7/me/friends", params={"access_token": token}
        ) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #cc55cf727b9414fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/logging_middleware.py:147

            coro = session.get(f"http://localhost:8080/hello/User{i}")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #d38deef88ccbd644 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/token_refresh_middleware.py:65

            async with session.post(
                self.token_endpoint,
                json={"refresh_token": self.refresh_token},
                middlewares=(),  # Disable middleware for this request
            ) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #b6f79bbc1b0859fa — Filesystem access.

pkgs/python/[email protected]/examples/web_ws.py:20

        with open(WS_FILE, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b38187065e6729f — Filesystem access.

pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:12

data = tomllib.loads(Path("pyproject.toml").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59eca68064d13818 — Filesystem access.

pkgs/python/[email protected]/requirements/sync-direct-runtime-deps.py:19

with open(Path("requirements", "runtime-deps.in"), "w") as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41463d6685806194 — Environment-variable access.

pkgs/python/[email protected]/setup.py:13

    os.environ.get("AIOHTTP_USE_SYSTEM_DEPS", os.environ.get("USE_SYSTEM_DEPS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8f9405bc19b75b1 — Environment-variable access.

pkgs/python/[email protected]/setup.py:15

NO_EXTENSIONS: bool = bool(os.environ.get("AIOHTTP_NO_EXTENSIONS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #840d7c982f9ce21c — Environment-variable access.

pkgs/python/[email protected]/setup.py:16

CYTHON_TRACING: bool = bool(os.environ.get("AIOHTTP_CYTHON_TRACE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cc110852a86a9b2a — Filesystem access.

pkgs/python/[email protected]/tools/check_sum.py:30

        hasher.update(full_src.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #254967f9bb35ce18 — Filesystem access.

pkgs/python/[email protected]/tools/check_sum.py:37

        dst_hash = dst.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c73272cdbbe37852 — Filesystem access.

pkgs/python/[email protected]/tools/check_sum.py:41

        dst.write_text(src_hash)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3e31f9d20e762b57 — Filesystem access.

pkgs/python/[email protected]/tools/cleanup_changes.py:30

    changes = (root / "CHANGES.rst").read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2a024154dd32ce40 — Filesystem access.

pkgs/python/[email protected]/tools/gen.py:16

    code = compile(hdrs_file.read_text(), str(hdrs_file), "exec")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

anthropic

python dependency

expand_more 122 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #b1efc7dc0936e622 — Environment-variable access.

pkgs/python/[email protected]/examples/agents.py:9

    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #aa2084c0da0f8eed — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:15 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:15

    print("Created environment:", environment.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #06ac5d02af33c916 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:22 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:22

    print("Created agent:", agent.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #89a3e2109124af18 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:29 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:29

    print("Created session:", session.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #f63e2ade385c9bf3 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents.py:45 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:9 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents.py:45

            print(event.to_json(indent=2))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #9e6ddb4eeb888bbf — Environment-variable access.

pkgs/python/[email protected]/examples/agents_comprehensive.py:18

    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #da0d401ec0071533 — Environment-variable access.

pkgs/python/[email protected]/examples/agents_comprehensive.py:20

    github_token = os.environ.get("GITHUB_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #cfb0bb19f3a6abdf — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:28 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:28

    print("Created environment:", environment.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #0dd568ac26d2261b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:32 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:32

    print("Created vault:", vault.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #b85a2ddb95aa8ad8 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:43 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:43

    print("Created credential:", credential.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #3a6eb115404ccedc — Filesystem access.

pkgs/python/[email protected]/examples/agents_comprehensive.py:47

    with open(skill_md_path, "rb") as skill_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #b401d1d90a6f473e — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:52 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:52

    print("Created skill:", skill.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #75d414e5d7db50ec — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:75 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:75

    print("Created agent v1:", agent_v1.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #645d4b50577d1fe5 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:86 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:86

    print("Patched agent to v2:", agent.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #9145f75923888426 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:89 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:89

    print("Agent versions:", versions.data)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #b4eaaf37f4c8c0ce — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:97 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:97

    print("Created session:", session.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #575037297276cd32 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_comprehensive.py:108 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:18 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_comprehensive.py:108

            print(event.to_json(indent=2))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #fe29d66287f3f5e1 — Environment-variable access.

pkgs/python/[email protected]/examples/agents_with_files.py:10

    anthropic = Anthropic(api_key=os.environ.get("ANTHROPIC_API_KEY"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low pii_flow tooling Excluded from app score unreachable #b49ef9589e363b44 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:16 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:16

    print("Created environment:", environment.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #8222e0807e941fc1 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:32 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:32

    print("Created agent:", agent.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #0657b8533911df4b — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:38 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:38

    print("Uploaded file:", file.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #e2d0e20299120092 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:52 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:52

    print("Created session:", session.id)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #4c9918c3c93307e5 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:55 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:55

    print("Listed session resources:", resources.data)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low pii_flow tooling Excluded from app score unreachable #fa74019bbf872799 — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process. Non-production path — not application runtime.

pkgs/python/[email protected]/examples/agents_with_files.py:76 · flow /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:10 → /tmp/closeopen-0bd58div/pkgs/python/[email protected]/examples/agents_with_files.py:76

            print(event.to_json(indent=2))

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

low env_fs tooling Excluded from app score unreachable #2065c0ca7988a71e — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-observe-tool-calls.py:46

    val = os.environ.get(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7325b953dcc244e1 — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-observe-tool-calls.py:64

    workdir = os.environ.get("ANTHROPIC_WORKDIR", ".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4f40f9a3e5f0fec4 — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-self-hosted-sandbox-worker.py:48

    val = os.environ.get(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3bbfa26314d55605 — Environment-variable access.

pkgs/python/[email protected]/examples/managed-agents-self-hosted-sandbox-worker.py:60

    workdir = os.environ.get("ANTHROPIC_WORKDIR", ".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #70a086b69e48af7b — Environment-variable access.

pkgs/python/[email protected]/examples/workload_identity.py:70

        identity_token_provider=lambda: os.environ["ANTHROPIC_IDENTITY_TOKEN"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #1da17b743023c07d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/anthropic/_base_client.py:325

        return await self._client.request(self._page_cls, self._options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #d49f8c0844b8959d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:107

    if api_key is not None and os.environ.get("ANTHROPIC_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b9c9943345a83b1 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:109

    if auth_token is not None and os.environ.get("ANTHROPIC_AUTH_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b76098dc5967aa7 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:214

            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3973667800cd9320 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:215

            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb2c402231ce0272 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:221

            webhook_key = os.environ.get("ANTHROPIC_WEBHOOK_SIGNING_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f839d05df73bbaa2 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:225

            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95154a2a77a64406 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:234

        custom_headers_env = os.environ.get("ANTHROPIC_CUSTOM_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f236e2afd2b71af8 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:634

            api_key = os.environ.get("ANTHROPIC_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #548a4f571cddb13b — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:635

            auth_token = os.environ.get("ANTHROPIC_AUTH_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f04018a9afc0422d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:641

            webhook_key = os.environ.get("ANTHROPIC_WEBHOOK_SIGNING_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #afdaf18aa5e18c27 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:645

            base_url = os.environ.get("ANTHROPIC_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e22235e549fd31d2 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_client.py:654

        custom_headers_env = os.environ.get("ANTHROPIC_CUSTOM_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8076df1254845b6 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:69

            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7abbf4b856da741e — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:81

        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fadc6466d8547401 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:111

            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #680e10f4a909b00b — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_files.py:123

        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb43b65a6ddae51b — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_legacy_response.py:464

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #876be6e958920a49 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_legacy_response.py:477

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6cd525598a8469b — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_models.py:120

            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #319e5a897beaa84e — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_response.py:537

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b87b8f95e905232e — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_response.py:579

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6b6ec6416915804 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/_utils/_logs.py:17

    env = os.environ.get("ANTHROPIC_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36b04ac8c1e60dd5 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:250

            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0dd133e48bbdf47d — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_utils/_transform.py:418

            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #667e0f3f4db801c1 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/_utils/_utils.py:379

    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3448f296130353c — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/_files.py:25

        files.append((path.relative_to(relative_to).as_posix(), path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d147ded741ba17d8 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/_files.py:42

        files.append((path.relative_to(relative_to).as_posix(), await path.read_bytes()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f9f6698095784da — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/aws/_credentials.py:25

        value = os.environ.get(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b06bc06ff9bc3ce — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/aws/_credentials.py:90

    return os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8703c892be4896c3 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:77

    aws_region = os.environ.get("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ee56d2f2ed72e73 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:165

            api_key = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #770321515ffc31c0 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:190

            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7890da3222a9c389 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:345

            api_key = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd6c8d76c74093f2 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_client.py:370

            base_url = os.environ.get("ANTHROPIC_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90cb7a442160cc67 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/bedrock/_mantle.py:144

        base_url = os.environ.get("ANTHROPIC_BEDROCK_MANTLE_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9616b278100875ce — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:33

    federation_rule_id = os.environ.get(ENV_FEDERATION_RULE_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a61117c8ecfadc5 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:34

    organization_id = os.environ.get(ENV_ORGANIZATION_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4e887999a4ce08a — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:35

    has_literal_token = ENV_IDENTITY_TOKEN in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76fbe8e3f89e50a6 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:50

            value = os.environ.get(ENV_IDENTITY_TOKEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84deafef87381a1f — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:65

        service_account_id=os.environ.get(ENV_SERVICE_ACCOUNT_ID),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #914947a96be7906f — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:69

        workspace_id=os.environ.get(ENV_WORKSPACE_ID) or None,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07aa4879f2665b6e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:70

        scope=os.environ.get(ENV_SCOPE),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #681e6e1a4242700d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:108

    if os.environ.get(ENV_API_KEY):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c8cd2c8bcdd579b — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:112

    auth_token = os.environ.get(ENV_AUTH_TOKEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #475266f3c10f29c9 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_chain.py:119

    env_explicit = bool(os.environ.get(ENV_PROFILE) or os.environ.get(ENV_CONFIG_DIR))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8631ff9abfc0c61 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:78

    env = os.environ.get(ENV_CONFIG_DIR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cb02ef022402f33 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:82

        appdata = os.environ.get("APPDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c20a5db9ee76b83 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:92

        name = (_config_dir() / "active_config").read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4dc821a6e94ff7fa — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:105

    env = os.environ.get(ENV_PROFILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6144ef5194b617ee — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:224

    env = os.environ.get(ENV_IDENTITY_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03af00572dd992f9 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:240

    if os.environ.get(ENV_PROFILE) or os.environ.get(ENV_CONFIG_DIR):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b1e49e72d2b9159 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:244

    if os.environ.get(ENV_FEDERATION_RULE_ID) and os.environ.get(ENV_ORGANIZATION_ID):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f258ea59f171f31 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_constants.py:245

        if os.environ.get(ENV_IDENTITY_TOKEN_FILE) or os.environ.get(ENV_IDENTITY_TOKEN):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e64046076bb6799 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:96

            v = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6822236057005952 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:110

            v = os.environ.get(ENV_IDENTITY_TOKEN_FILE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e89205a3b7aaf6ce — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:136

        value = os.environ.get(self._env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #768ae44a78be6e2c — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:284

            raw = self._config_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b946638368aae7d5 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:374

            creds: Dict[str, Any] = _wrap_secret_fields(json.loads(path.read_text(encoding="utf-8")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #171eff80ed4cb5a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:538

            resp = self._get_http_client().post(
                f"{self._base_url}{TOKEN_ENDPOINT}",
                # Serialized inline so the raw request bytes are never bound
                # to a local here; SecretStr values unwrap at dump time.
                content=_json_dumps_secrets(body),
                headers={
                    "Content-Type": "application/json",
                    # oauth-2025-04-20 unlocks the token endpoint family. Do
                    # NOT send oidc-federation-2026-04-01 — that's a routing
                    # switch that misroutes refresh_token grants to the Go
                    # userauth handler, which only accepts jwt-bearer.
                    "anthropic-beta": OAUTH_API_BETA_HEADER,
                    "User-Agent": _user_agent(),
                },
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #e780ac3dc67c13dd — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_providers.py:746

            content = self._path.read_text(encoding="utf-8").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #5dcfd66e5fcf8c8d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/anthropic/lib/credentials/_workload.py:259

            resp = self._http_client.post(
                url,
                # Serialized inline so the raw request bytes are never bound
                # to a local here; SecretStr values unwrap at dump time.
                content=_json_dumps_secrets(body),
                headers={
                    "anthropic-beta": _JWT_BEARER_BETA_HEADER,
                    "Content-Type": "application/json",
                    "User-Agent": _user_agent(),
                },
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #608fa4999c47755d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/environments/_worker.py:160

    resolved = value or os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e927d3cb523d2908 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:157

        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec2ed9dbc7b61fa0 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:158

        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba5704a1f07233a9 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:159

        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21babe7027e2dd44 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:382

        api_key = api_key if api_key is not None else os.environ.get("ANTHROPIC_FOUNDRY_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06bc78fa5dac5040 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:383

        resource = resource if resource is not None else os.environ.get("ANTHROPIC_FOUNDRY_RESOURCE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1693d82feed8a3b7 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/foundry.py:384

        base_url = base_url if base_url is not None else os.environ.get("ANTHROPIC_FOUNDRY_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d424dea573748072 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:247

            location = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_LOCATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #661ac42ce2e4f17d — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:252

            project = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a2ceb037a3fd092 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:254

            project = os.environ.get("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96cb42c380e92a86 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:260

            base_url = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d0d1f048bc641068 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:266

            workspace_id = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c93055f092e049a — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:493

            location = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_LOCATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db4d859a1c3ecc3e — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:498

            project = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d09e71d4d5c6730 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:500

            project = os.environ.get("GOOGLE_CLOUD_PROJECT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #242560b12b214352 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:506

            base_url = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0976d883be30da51 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/google_cloud/_client.py:510

            workspace_id = os.environ.get("ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #1bd59f22c210ba22 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:356

        return full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #42edbb23eb44da26 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_beta_builtin_memory_tool.py:653

        return await full_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #302c98d30c5d00bb — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_skills.py:138

                with zf.open(info) as src, open(target, "wb") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #66bb1da268d438bb — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/_skills.py:164

            with extracted as src, open(target, "wb") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #0d72b5e59d63fb72 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:123

    return {k: v for k, v in os.environ.items() if not k.startswith("ANTHROPIC_")}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #bffd0b718fa22e26 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:512

            text = target.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #b06de87c53b80750 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:540

            target.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #e699a9d5b5096f2b — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:570

            text = target.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #7521d6a9e8489516 — Filesystem access.

pkgs/python/[email protected]/src/anthropic/lib/tools/agent_toolset.py:582

            target.write_text(updated)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b073422d53e6ad99 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:46

        project_id = os.environ.get("ANTHROPIC_VERTEX_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c0c2193d11edfb8 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:114

            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2276722c8d778d94 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:121

            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7afc1513afb6eda0 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:278

            region = os.environ.get("CLOUD_ML_REGION", NOT_GIVEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b355164e85a9efc0 — Environment-variable access.

pkgs/python/[email protected]/src/anthropic/lib/vertex/_client.py:285

            base_url = os.environ.get("ANTHROPIC_VERTEX_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ascii_colors

python dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #f89edc102940fd98 — Filesystem access.

pkgs/python/[email protected]/ascii_colors/handlers.py:83

            self._stream = open(self.filename, self.mode, encoding=self.encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

asyncpg

python dependency

expand_more 52 low-confidence finding(s)

low env_fs dependency Excluded from app score #6d8b3263b43e8b4d — Environment-variable access.

pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:102

        if os.environ.get('USE_UVLOOP'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f53dde473e819420 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:246

        pg_host = os.environ.get('PGHOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bdc6178dd55e561 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:352

        if not os.environ.get('PGHOST') and not kwargs.get('dsn'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c919119a51f8bbab — Environment-variable access.

pkgs/python/[email protected]/asyncpg/_testbase/__init__.py:509

        if not os.environ.get('PGHOST') and not kwargs.get('dsn'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fdd69a03ef0aa971 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:64

    if _system == 'Windows' and os.environ.get("GITHUB_ACTIONS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5aa3c2453c4d3f30 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:82

            os.environ.get('PGINSTALLATION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a23ae9cf1bc7dcd4 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:83

            or os.environ.get('PGBIN')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7d403268eab30bd — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:215

            if os.getenv('ASYNCPG_DEBUG_SERVER'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e98ecdc6fe7a3011 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:245

            if os.getenv('ASYNCPG_DEBUG_SERVER'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d28abcf7a908785b — Filesystem access.

pkgs/python/[email protected]/asyncpg/cluster.py:377

            with open(pg_hba, 'w'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #000f18bb88448a23 — Filesystem access.

pkgs/python/[email protected]/asyncpg/cluster.py:412

            with open(pg_hba, 'a') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f88971dc375f9dcd — Filesystem access.

pkgs/python/[email protected]/asyncpg/cluster.py:466

            with open(pidfile, 'rt') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #584b15abf1cf2f04 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:566

                os.environ.get('PGINSTALLATION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9159d03de58f9384 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:567

                or os.environ.get('PGBIN')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07347a94c896e1d2 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/cluster.py:573

                pathenv = os.environ.get('PATH').split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7473862a51fa0267 — Filesystem access.

pkgs/python/[email protected]/asyncpg/cluster.py:671

            with open(os.path.join(self._data_dir, 'recovery.conf'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7af349c5fb40829 — Filesystem access.

pkgs/python/[email protected]/asyncpg/cluster.py:680

            f = open(os.path.join(self._data_dir, 'standby.signal'), 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f5d31f658cf6fb6 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:201

        portspec = os.environ.get('PGPORT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa59278abd6607ee — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:306

            connection_service_file = os.getenv('PGSERVICEFILE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dcd87408917b99a3 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:555

        service = os.environ.get('PGSERVICE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bab07ef6a546a25 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:557

        hostspec = os.environ.get('PGHOST')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d47449eb698444e9 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:577

        portspec = os.environ.get('PGPORT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #220bfaf4c5310136 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:595

        user = os.getenv('PGUSER')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e502702b0491358 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:600

        password = os.getenv('PGPASSWORD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89ed5ab8902f6964 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:603

        database = os.getenv('PGDATABASE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e442d1bae7628de — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:618

            passfile = os.getenv('PGPASSFILE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #89aaeaa8a89dc760 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:653

        ssl = os.getenv('PGSSLMODE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f90a7d19727ef0e — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:664

            sslnegotiation = os.environ.get("PGSSLNEGOTIATION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a246e3b0a9c2f03d — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:699

                    sslrootcert = os.getenv('PGSSLROOTCERT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfbdd3777a698c15 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:745

                    sslcrl = os.getenv('PGSSLCRL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ead5da81b7deba1f — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:764

                sslkey = os.getenv('PGSSLKEY')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ff7f0d925664733 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:772

                sslcert = os.getenv('PGSSLCERT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f0f534a0dedc738 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:791

                keylogfile = os.environ.get('SSLKEYLOGFILE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1251dd66c9ad612 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:796

                ssl_min_protocol_version = os.getenv('PGSSLMINPROTOCOLVERSION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25e50b47df908a9d — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:805

                ssl_max_protocol_version = os.getenv('PGSSLMAXPROTOCOLVERSION')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee35089ecb65194d — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:826

        target_session_attrs = os.getenv(
            "PGTARGETSESSIONATTRS", SessionAttribute.any
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d4b4dc52c290ec6 — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:841

        krbsrvname = os.getenv('PGKRBSRVNAME')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79853dd458628e2d — Environment-variable access.

pkgs/python/[email protected]/asyncpg/connect_utils.py:844

        gsslib = os.getenv('PGGSSLIB')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #084cf3f3da1a316f — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:11

with open(version_file, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b827470434dd84b — Filesystem access.

pkgs/python/[email protected]/setup.py:40

with open(str(_ROOT / 'README.rst')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d214f06159b1439 — Filesystem access.

pkgs/python/[email protected]/setup.py:44

with open(str(_ROOT / 'asyncpg' / '_version.py')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fef2e61a767e56bd — Environment-variable access.

pkgs/python/[email protected]/setup.py:60

        v = os.environ.get('PATH')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a50adc43cc1bf06a — Filesystem access.

pkgs/python/[email protected]/setup.py:82

        with open(str(filename)) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #210b16590c97897e — Filesystem access.

pkgs/python/[email protected]/setup.py:89

        with open(str(filename), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #766d42c5158c7b5d — Environment-variable access.

pkgs/python/[email protected]/setup.py:137

        if os.environ.get('ASYNCPG_DEBUG'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d369cde560f85fb0 — Environment-variable access.

pkgs/python/[email protected]/setup.py:159

            self.cython_always = bool(os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8902466784c72385 — Environment-variable access.

pkgs/python/[email protected]/setup.py:159

            self.cython_always = bool(os.environ.get(
                "ASYNCPG_BUILD_CYTHON_ALWAYS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9d04e4d8204bf85 — Environment-variable access.

pkgs/python/[email protected]/setup.py:163

            self.cython_annotate = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85ba8353a4d8bfe9 — Environment-variable access.

pkgs/python/[email protected]/setup.py:163

            self.cython_annotate = os.environ.get(
                "ASYNCPG_BUILD_CYTHON_ANNOTATE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b693080329139096 — Environment-variable access.

pkgs/python/[email protected]/setup.py:167

            self.cython_directives = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a325e0cd9012049b — Environment-variable access.

pkgs/python/[email protected]/setup.py:167

            self.cython_directives = os.environ.get(
                "ASYNCPG_BUILD_CYTHON_DIRECTIVES")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da551bdec3f458ba — Environment-variable access.

pkgs/python/[email protected]/setup.py:239

    or os.environ.get("ASYNCPG_BUILD_CYTHON_ALWAYS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cairosvg

python dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #cfcea4e96349c723 — Filesystem access.

pkgs/python/[email protected]/cairosvg/__init__.py:21

VERSION = __version__ = (ROOT / 'VERSION').read_text().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59f059ccdb84c231 — Filesystem access.

pkgs/python/[email protected]/cairosvg/test_api.py:42

    with open(filename, 'rb') as file_object:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #453eb35682226fc8 — Filesystem access.

pkgs/python/[email protected]/cairosvg/test_api.py:140

            sys.stdin = open(input_, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #c814b60c22b78967 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/cairosvg/url.py:84

    return urlopen(Request(url, headers=HTTP_HEADERS)).read()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

configparser

python dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #87066f33a3d3e608 — Filesystem access.

pkgs/python/[email protected]/backports/configparser/__init__.py:813

                with open(filename, encoding=encoding) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

cryptography

python dependency

expand_more 22 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #7d4f99e6e3780f06 — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:88

with open(os.path.join(base_dir, "src", "cryptography", "__about__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #15cb95fa4eaebea1 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/aes-192-gcm-siv/generate_aes192gcmsiv.py:52

    with open(filename) as vector_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3bad5a2094b18884 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/aes-192-gcm-siv/generate_aes192gcmsiv.py:81

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #47d5e9d1617d3ac7 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/arc4/generate_arc4.py:92

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #09abc41ecae20192 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/cast5/generate_cast5.py:28

    with open(filename) as vector_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bdb271f7120d1a03 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/cast5/generate_cast5.py:52

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9802c4938f1d2494 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/hkdf/generate_hkdf.py:34

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #082cdf49da02bb39 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/idea/generate_idea.py:18

    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f9fbac0844d79a1b — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/idea/generate_idea.py:50

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0717d563188b37ef — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/idea/verify_idea.py:22

    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #73ce71ce2e408788 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/rsa-oaep-sha2/generate_rsa_oaep_sha2.py:98

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0ac48da0c716a7bb — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/seed/generate_seed.py:18

    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #32447d16bd628374 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/seed/generate_seed.py:49

    with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #afa4745d122724d5 — Filesystem access.

pkgs/python/[email protected]/docs/development/custom-vectors/seed/verify_seed.py:20

    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #568a1f530ca70bfe — Environment-variable access.

pkgs/python/[email protected]/noxfile.py:64

        rustflags = os.environ.get("RUSTFLAGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #adbf5beaa27e69e9 — Environment-variable access.

pkgs/python/[email protected]/noxfile.py:239

    rustflags = os.environ.get("RUSTFLAGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4a612ae6c4abd9b — Environment-variable access.

pkgs/python/[email protected]/noxfile.py:291

    if "CARGO_INCREMENTAL" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c05621cff1cfabc9 — Filesystem access.

pkgs/python/[email protected]/noxfile.py:406

        with open(f"{uuid.uuid4()}.lcov", "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #958876fce6d786e3 — Filesystem access.

pkgs/python/[email protected]/release.py:54

    content = p.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29db93a035cd60db — Filesystem access.

pkgs/python/[email protected]/release.py:60

    p.write_text(new_content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ac3b6ef6833afce — Environment-variable access.

pkgs/python/[email protected]/src/_cffi_src/build_openssl.py:49

    out_dir = os.environ["OUT_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #70bcd229b0664a64 — Filesystem access.

pkgs/python/[email protected]/src/_cffi_src/utils.py:16

with open(os.path.join(base_src, "cryptography", "__about__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

datasets

python dependency

expand_more 77 low-confidence finding(s)

low env_fs dependency Excluded from app score #dcdea4bae3ca5b68 — Filesystem access.

pkgs/python/[email protected]/setup.py:249

    long_description=open("README.md", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #272824ab114b8055 — Filesystem access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:2065

        with open(dataset_state_json_path, encoding="utf-8") as state_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #591e6bff28299fa7 — Filesystem access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:2067

        with open(dataset_info_path, encoding="utf-8") as dataset_info_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b0a0b7803e72fd2 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3537

            prev_env = deepcopy(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #537daa8c04d4d63e — Environment-variable access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3550

            os.environ["TOKENIZERS_PARALLELISM"] = "false"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e325f923eb279151 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3552

            prev_env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #700ee5cde06097f4 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:3621

                        os.environ = prev_env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0192e5106f6aa6ca — Filesystem access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:6886

        legacy_dataset_info: dict = json.loads(fs.read_text(config.DATASETDICT_INFOS_FILENAME, encoding="utf-8")).get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d010a72f32d39ee6 — Filesystem access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:6895

        dataset_card = DatasetCard(fs.read_text(config.REPOCARD_FILENAME, newline="", encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce87bde24bc88b20 — Filesystem access.

pkgs/python/[email protected]/src/datasets/arrow_dataset.py:6993

        legacy_dataset_infos: dict = json.loads(fs.read_text(config.DATASETDICT_INFOS_FILENAME, encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1193407e45ddc7cd — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:21

HF_ENDPOINT = os.environ.get("HF_ENDPOINT", "https://huggingface.co")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f55fc99ce6394474 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:42

USE_TF = os.environ.get("USE_TF", "AUTO").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1100f9101dcecaf — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:43

USE_TORCH = os.environ.get("USE_TORCH", "AUTO").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06114d7d676aea92 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:44

USE_JAX = os.environ.get("USE_JAX", "AUTO").upper()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #151b908c82ea9be9 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:154

XDG_CACHE_HOME = os.getenv("XDG_CACHE_HOME", DEFAULT_XDG_CACHE_HOME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b41595de9b1b0a3 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:156

HF_CACHE_HOME = os.path.expanduser(os.getenv("HF_HOME", DEFAULT_HF_CACHE_HOME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3fb7b3b200c43d5 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:159

HF_DATASETS_CACHE = Path(os.getenv("HF_DATASETS_CACHE", DEFAULT_HF_DATASETS_CACHE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7791e4f74cde5c13 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:162

HF_MODULES_CACHE = Path(os.getenv("HF_MODULES_CACHE", DEFAULT_HF_MODULES_CACHE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cc25da20c2eeba8 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:166

DOWNLOADED_DATASETS_PATH = Path(os.getenv("HF_DATASETS_DOWNLOADED_DATASETS_PATH", DEFAULT_DOWNLOADED_DATASETS_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5b8c51c54f70975 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:170

EXTRACTED_DATASETS_PATH = Path(os.getenv("HF_DATASETS_EXTRACTED_DATASETS_PATH", DEFAULT_EXTRACTED_DATASETS_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc218cec6e8200e6 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:177

    os.environ.get("HF_UPDATE_DOWNLOAD_COUNTS", "AUTO").upper() in ENV_VARS_TRUE_AND_AUTO_VALUES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #316af6578148e905 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:214

_offline = os.environ.get("HF_DATASETS_OFFLINE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #705f9fe56a5954ec — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:223

__HF_DATASETS_DISABLE_PROGRESS_BARS = os.environ.get("HF_DATASETS_DISABLE_PROGRESS_BARS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45afeb4a250975d7 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/config.py:232

IN_MEMORY_MAX_SIZE = float(os.environ.get("HF_DATASETS_IN_MEMORY_MAX_SIZE", DEFAULT_IN_MEMORY_MAX_SIZE))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #728f10afc8c31f53 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/download/download_manager.py:212

                if os.environ.get("HF_DATASETS_STACK_MULTIPROCESSING_DOWNLOAD_PROGRESS_BARS") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb3df00e16c7b377 — Filesystem access.

pkgs/python/[email protected]/src/datasets/features/features.py:1179

        with open(names_filepath, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25ddb56aa3597c6c — Environment-variable access.

pkgs/python/[email protected]/src/datasets/fingerprint.py:53

        tmpdir = os.environ.get("TMPDIR") or os.environ.get("TEMP") or os.environ.get("TMP")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a35be20a243be475 — Filesystem access.

pkgs/python/[email protected]/src/datasets/info.py:344

            with open(dataset_infos_path, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7187d3d103512049 — Filesystem access.

pkgs/python/[email protected]/src/datasets/info.py:373

            with open(os.path.join(dataset_infos_dir, config.DATASETDICT_INFOS_FILENAME), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ae7acfeda8ccd32 — Filesystem access.

pkgs/python/[email protected]/src/datasets/load.py:434

            with open(standalone_yaml_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96b8b9a310dd1bd8 — Filesystem access.

pkgs/python/[email protected]/src/datasets/load.py:488

            with open(os.path.join(self.path, config.DATASETDICT_INFOS_FILENAME), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ad97dc776d5b4c4 — Filesystem access.

pkgs/python/[email protected]/src/datasets/load.py:612

            with open(standalone_yaml_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1253ee8067ac7da — Filesystem access.

pkgs/python/[email protected]/src/datasets/load.py:697

            with open(dataset_infos_path, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #439451733c6be452 — Filesystem access.

pkgs/python/[email protected]/src/datasets/load.py:873

            dataset_card_data = DatasetCard(hffs.read_text(readme_path, newline="", encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e30e7845920c9b4 — Filesystem access.

pkgs/python/[email protected]/src/datasets/load.py:877

            standalone_yaml_data = yaml.safe_load(hffs.read_text(standalone_yaml_path, newline="", encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #253802c37e31fcde — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/arrow/arrow.py:40

                    with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f070e95299e52104 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/arrow/arrow.py:62

            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ebed5fe3539bb3f — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/cache/cache.py:52

            or json.loads(Path(cached_directory_path, "dataset_info.json").read_text(encoding="utf-8"))["config_name"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cae05e7c231f5470 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/cache/cache.py:80

            or json.loads(Path(_cached_directory_path, "dataset_info.json").read_text(encoding="utf-8"))["config_name"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11ffd99a0858f489 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/cache/cache.py:185

            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20208916a4fa2f43 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/conll/conll.py:126

                with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a32957698aedb60 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/eval/eval.py:62

            with open(sample_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dccef54f740f239a — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/folder_based_builder/folder_based_builder.py:313

            with open(metadata_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28e25a9dd386cbd1 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/folder_based_builder/folder_based_builder.py:352

            with open(metadata_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4db2357d7fb6fb09 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/hdf5/hdf5.py:59

                    with open(first_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08ce0099e94e05e9 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/hdf5/hdf5.py:75

                with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61a9953c1fc164a6 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:159

                    with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d570651242e8b18 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:172

                    trace_events = trace_file.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3eb3757793c5e65b — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:199

                    with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73a334aa60b8d1c6 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/json/json.py:288

                                    with open(
                                        file, encoding=self.config.encoding, errors=self.config.encoding_errors
                                    ) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1eecd6528090ad7 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/lance/lance.py:86

            data = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78168cd9e8b69ab9 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/pandas/pandas.py:55

            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50f0a4c7ed9531f0 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/parquet/parquet.py:126

                        with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fc6f966898bf709 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/parquet/parquet.py:173

                with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d7a16ef3f242a1c — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/parquet/parquet.py:199

                with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32fab238f44e5f8b — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/spark/spark.py:148

            open(probe_file, "a")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d1155719e5758f0 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/text/text.py:94

                with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed82c9a7bbdcd34d — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/tsfile/tsfile.py:736

            with open(file, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d3b487bca54fd70 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/webdataset/_tenbin.py:276

    with open(fname, "wb") as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #264111c7260b1776 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/webdataset/_tenbin.py:284

    with open(fname, "rb") as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fba3afb088b8fbd0 — Filesystem access.

pkgs/python/[email protected]/src/datasets/packaged_modules/xml/xml.py:67

            with open(file, encoding=self.config.encoding, errors=self.config.encoding_errors) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33c40fd73f878fe4 — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/extract.py:72

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6959fc4d1dfb8cce — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/extract.py:141

            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #318fc5ee08061c11 — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/extract.py:172

            with open(path, "rb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da613928c75cf41e — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/extract.py:235

            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf989ad85670c91d — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/extract.py:301

        with open(input_path, "rb") as ifh, open(output_path, "wb") as ofh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a21aae16ff8af753 — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/extract.py:311

            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb02102e9d56e3f2 — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/extract.py:377

            with open(output_path, "wb") as extracted_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5342a6507cc898b7 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/utils/file_utils.py:302

    return patch.dict(os.environ, {"HF_DATASETS_STACK_MULTIPROCESSING_DOWNLOAD_PROGRESS_BARS": "1"})

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a63a0e1dce0427d — Environment-variable access.

pkgs/python/[email protected]/src/datasets/utils/file_utils.py:324

            if os.environ.get("HF_DATASETS_STACK_MULTIPROCESSING_DOWNLOAD_PROGRESS_BARS") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7fcddaecd1ae88a — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/file_utils.py:403

        with open(incomplete_path, "w+b") as temp_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6a258d826949602 — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/file_utils.py:414

        with open(meta_path, "w", encoding="utf-8") as meta_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32462670f71e6213 — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/file_utils.py:967

        return open(main_hop, mode, *args, **kwargs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28b68c77ebc54535 — Filesystem access.

pkgs/python/[email protected]/src/datasets/utils/info_utils.py:84

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2af58940b57944be — Environment-variable access.

pkgs/python/[email protected]/src/datasets/utils/logging.py:54

    env_level_str = os.getenv("DATASETS_VERBOSITY", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd3fdf168e674aa1 — Environment-variable access.

pkgs/python/[email protected]/src/datasets/utils/tf_utils.py:413

        os.environ["TF_CPP_MIN_LOG_LEVEL"] = "3"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #244e34f9314c04bb — Environment-variable access.

pkgs/python/[email protected]/src/datasets/utils/tqdm.py:115

        elif kwargs.get("disable") is None and os.getenv("TQDM_POSITION") == "-1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

defusedxml

python dependency

expand_more 8 low-confidence finding(s)

low env_fs dependency Excluded from app score #8f72197860879fd4 — Filesystem access.

pkgs/python/[email protected]/defusedxml/expatbuilder.py:84

        fp = open(file, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11c0f6bb79ed9206 — Filesystem access.

pkgs/python/[email protected]/other/python_genshi.py:6

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #135a703323ae1547 — Filesystem access.

pkgs/python/[email protected]/setup.py:27

with open("README.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd8a7b9f7c4012bb — Filesystem access.

pkgs/python/[email protected]/setup.py:29

with open("CHANGES.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ff54e50bf83675a — Environment-variable access.

pkgs/python/[email protected]/tests.py:59

os.environ["http_proxy"] = "http://127.0.9.1:9"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f6ed05c9db7b5c7 — Environment-variable access.

pkgs/python/[email protected]/tests.py:60

os.environ["https_proxy"] = os.environ["http_proxy"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #926c0382333d67d1 — Environment-variable access.

pkgs/python/[email protected]/tests.py:61

os.environ["ftp_proxy"] = os.environ["http_proxy"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3420cecd44be2d7 — Filesystem access.

pkgs/python/[email protected]/tests.py:83

        with io.open(xmlfile, mode) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

distro

python dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #d93df2401825592e — Environment-variable access.

pkgs/python/[email protected]/src/distro/distro.py:75

_UNIXCONFDIR = os.environ.get("UNIXCONFDIR", "/etc")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8eac036d2a5cba7c — Environment-variable access.

pkgs/python/[email protected]/src/distro/distro.py:76

_UNIXUSRLIBDIR = os.environ.get("UNIXUSRLIBDIR", "/usr/lib")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cb62ac25bfec47b — Filesystem access.

pkgs/python/[email protected]/src/distro/distro.py:1099

            with open(self.os_release_file, encoding="utf-8") as release_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83ce423deec65780 — Filesystem access.

pkgs/python/[email protected]/src/distro/distro.py:1221

            with open(
                os.path.join(self.etc_dir, "debian_version"), encoding="ascii"
            ) as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be928611fb98391b — Filesystem access.

pkgs/python/[email protected]/src/distro/distro.py:1323

            with open(filepath, encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

fastapi

python dependency

expand_more 76 low-confidence finding(s)

low env_fs dependency Excluded from app score #2cd7d5a1d6eb9efd — Filesystem access.

pkgs/python/[email protected]/docs_src/background_tasks/tutorial001_py310.py:7

    with open("log.txt", mode="w") as email_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #525023ec23096505 — Filesystem access.

pkgs/python/[email protected]/docs_src/background_tasks/tutorial002_an_py310.py:9

    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2faf03fd300dcc1c — Filesystem access.

pkgs/python/[email protected]/docs_src/background_tasks/tutorial002_py310.py:7

    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3655692f6ed8eff8 — Filesystem access.

pkgs/python/[email protected]/docs_src/custom_response/tutorial008_py310.py:11

        with open(some_file_path, mode="rb") as file_like:  # (2)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #d483add42d874aa6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/dependencies/tutorial013_an_py310.py:25

    user = session.get(User, user_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #46d74c78379ac6eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/dependencies/tutorial014_an_py310.py:25

    user = session.get(User, user_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2da890f87f85195c — Filesystem access.

pkgs/python/[email protected]/docs_src/events/tutorial002_py310.py:8

    with open("log.txt", mode="a") as log:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25b54259fe984599 — Filesystem access.

pkgs/python/[email protected]/docs_src/generate_clients/tutorial004_py310.py:5

openapi_content = json.loads(file_path.read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d978645f2488c3b — Filesystem access.

pkgs/python/[email protected]/docs_src/generate_clients/tutorial004_py310.py:15

file_path.write_text(json.dumps(openapi_content))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #ac71e3d248d2ae25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial001_an_py310.py:60

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #741be94911657f81 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial001_an_py310.py:68

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #42a85fe00137a198 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial001_py310.py:56

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #710e893fa3ca520d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial001_py310.py:64

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e9dad4f401952b66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial002_an_py310.py:77

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1005b8d4d7f2e940 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial002_an_py310.py:85

    hero_db = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f55d2a4cc1fc2888 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial002_an_py310.py:98

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0bb2a1268f5b2a5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial002_py310.py:74

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #921042458f83ec85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial002_py310.py:84

    hero_db = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5e1ada78c398ad11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/docs_src/sql_databases/tutorial002_py310.py:97

    hero = session.get(Hero, hero_id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #48c25c07699b3f18 — Filesystem access.

pkgs/python/[email protected]/scripts/add_latest_release_date.py:12

    with open(RELEASE_NOTES_FILE) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0debc097e63afe8f — Filesystem access.

pkgs/python/[email protected]/scripts/add_latest_release_date.py:31

        with open(RELEASE_NOTES_FILE, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #2688e90f8c50616b — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/contributors.py:129

    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #fb6fa0a6aedbefa0 — Filesystem access.

pkgs/python/[email protected]/scripts/contributors.py:227

    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9a21f2b3269405f6 — Filesystem access.

pkgs/python/[email protected]/scripts/contributors.py:233

    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c28269d3a1febe3e — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:105

    return yaml.unsafe_load(en_config_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e615804ae067be3b — Environment-variable access.

pkgs/python/[email protected]/scripts/docs.py:129

    os.environ["DYLD_FALLBACK_LIBRARY_PATH"] = "/opt/homebrew/lib"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c00ec2f634806f33 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:143

    new_llm_prompt_path.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0237a72f14e5b312 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:223

    missing_translation = (docs_path / "missing-translation.md").read_text(
        encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6a4c9ba4ce994455 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:229

    translation_banner = translation_banner_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e8222e8ff7eeb93e — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:236

                markdown = translated_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7174556e1df56c37 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:238

                    staged_file.write_text(markdown, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2a9d72ba0635783d — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:242

                staged_file.write_text(
                    add_markdown_notice(markdown, banner), encoding="utf-8"
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #75b9c20794b5ec9e — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:246

                markdown = staged_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #75935c8bd46bd456 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:247

                staged_file.write_text(
                    add_markdown_notice(markdown, missing_translation),
                    encoding="utf-8",
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #59e9fcdd86f12f11 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:277

    config_path.write_text(
        yaml.dump(config, sort_keys=False, width=200, allow_unicode=True),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d7fac6cdc6bf7f16 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:295

    config = yaml.unsafe_load(config_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #14c9e2c1a3d241ee — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:349

    content = en_index.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #478bec6fb01e2f95 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:355

    sponsors = yaml.safe_load(sponsors_data_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b36f01ddc9206b30 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:384

    old_content = readme_path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4828f7251f1561d4 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:389

        readme_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8b6036e8350c0610 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:430

        en_config_path.write_text(
            yaml.dump(updated_config, sort_keys=False, width=200, allow_unicode=True),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #50d8834c1e206358 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:488

        language_names_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #66d9a7e4406e5675 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:542

    sponsors = yaml.safe_load(sponsors_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #919dde574dcd2382 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:553

    old_content = partial_path.read_text("utf-8") if partial_path.is_file() else ""

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9d5deff3a5b97ec2 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:558

        partial_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bce25f8a1201c7ea — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:609

    base_content = file_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6f3e8efd7ba402fc — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:657

        version_file.write_text(content_format, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4577e6efdc22c1f1 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:713

        content = md_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #06bab761cc7b8ae4 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:720

            md_file.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0ed8f14d81c93b32 — Filesystem access.

pkgs/python/[email protected]/scripts/docs.py:735

        all_docs_content += md_file.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #a72b3ebc04208d45 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/notify_translations.py:218

    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #afc42f94cc54eed8 — Filesystem access.

pkgs/python/[email protected]/scripts/notify_translations.py:319

    contents = settings.github_event_path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #37521ac61a31ac17 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/people.py:202

    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #e4750d08606219c8 — Filesystem access.

pkgs/python/[email protected]/scripts/people.py:384

    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e2b1078ffa18e899 — Filesystem access.

pkgs/python/[email protected]/scripts/people.py:390

    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b88665f49f207e59 — Filesystem access.

pkgs/python/[email protected]/scripts/prepare_release.py:146

    version_file_content = version_file.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f73bdaf73aea15e4 — Filesystem access.

pkgs/python/[email protected]/scripts/prepare_release.py:147

    release_notes_content = release_notes_file.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #85cf3ba674247971 — Filesystem access.

pkgs/python/[email protected]/scripts/prepare_release.py:152

    version_file.write_text(
        update_version_file(version_file_content, version, version_file)
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #69c6fa605a3bfac8 — Filesystem access.

pkgs/python/[email protected]/scripts/prepare_release.py:155

    release_notes_file.write_text(
        update_release_notes(
            release_notes_content, version, parsed_release_date, release_notes_file
        )
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #43ca2304e2c92765 — Filesystem access.

pkgs/python/[email protected]/scripts/prepare_release.py:178

    typer.echo(get_current_version(version_file.read_text(), version_file))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cb9c51a887838e2f — Filesystem access.

pkgs/python/[email protected]/scripts/prepare_release.py:206

    version = get_current_version(version_file.read_text(), version_file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #14dbad3fc3925b1a — Filesystem access.

pkgs/python/[email protected]/scripts/prepare_release.py:209

            release_notes_file.read_text(), version, release_notes_file

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #b8a5a51557b951f6 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/sponsors.py:100

    response = httpx.post(
        github_graphql_url,
        headers=headers,
        timeout=settings.httpx_timeout,
        json={"query": query, "variables": variables, "operationName": "Q"},
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #e87b4676a98f2b06 — Filesystem access.

pkgs/python/[email protected]/scripts/sponsors.py:148

    old_content = content_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #933797b7e43c3cae — Filesystem access.

pkgs/python/[email protected]/scripts/sponsors.py:154

    content_path.write_text(new_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #797105aaeedd158b — Filesystem access.

pkgs/python/[email protected]/scripts/topic_repos.py:52

    repos_old_content = repos_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0af61570d02893ff — Filesystem access.

pkgs/python/[email protected]/scripts/topic_repos.py:57

    repos_path.write_text(new_repos_content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a947b94cc23a11b2 — Filesystem access.

pkgs/python/[email protected]/scripts/translate.py:31

general_prompt = general_prompt_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #354bff87f3110733 — Filesystem access.

pkgs/python/[email protected]/scripts/translate.py:38

    return yaml.safe_load(Path("docs/language_names.yml").read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #03a86beb842ce5de — Filesystem access.

pkgs/python/[email protected]/scripts/translate.py:121

    lang_prompt_content = lang_prompt_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #982dd3ea496f1144 — Filesystem access.

pkgs/python/[email protected]/scripts/translate.py:129

    original_content = en_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9d3e8c8fb5137aec — Filesystem access.

pkgs/python/[email protected]/scripts/translate.py:133

        old_translation = out_path.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4fcadcbd8ee692c9 — Filesystem access.

pkgs/python/[email protected]/scripts/translate.py:178

    out_path.write_text(out_content, encoding="utf-8", newline="\n")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #82d3b953f1bd1a35 — Filesystem access.

pkgs/python/[email protected]/scripts/translation_fixer.py:81

        doc_lines = path.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #acaad014f3fdef28 — Filesystem access.

pkgs/python/[email protected]/scripts/translation_fixer.py:82

        en_doc_lines = en_doc_path.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #20ccd5184cae0358 — Filesystem access.

pkgs/python/[email protected]/scripts/translation_fixer.py:94

        path.write_text("\n".join(doc_lines), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-api-core

python dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #743f839ac1a0bb1b — Environment-variable access.

pkgs/python/[email protected]/google/api_core/client_logging.py:59

    scopes = os.getenv("GOOGLE_SDK_PYTHON_LOGGING_SCOPE", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #132cc25a80ba0980 — Environment-variable access.

pkgs/python/[email protected]/google/api_core/operations_v1/abstract_operations_base_client.py:307

            use_client_cert_str = os.getenv(
                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
            ).lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08d95586207c053a — Environment-variable access.

pkgs/python/[email protected]/google/api_core/operations_v1/abstract_operations_base_client.py:333

            use_mtls_env = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google-genai

python dependency

expand_more 87 low-confidence finding(s)

low env_fs dependency Excluded from app score #02c1fc513d723da5 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:110

  env_google_api_key = os.environ.get('GOOGLE_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86fd87996ad900cc — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:111

  env_gemini_api_key = os.environ.get('GEMINI_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #242652952d536307 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:616

      env_enterprise_str = os.environ.get('GOOGLE_GENAI_USE_ENTERPRISE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b89a5cd0e3bbb22e — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:617

      env_vertexai_str = os.environ.get('GOOGLE_GENAI_USE_VERTEXAI', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9cebbeaf042742ba — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:677

    env_project = os.environ.get('GOOGLE_CLOUD_PROJECT', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf89a83ba0317672 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:678

    env_location = os.environ.get('GOOGLE_CLOUD_LOCATION', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e669e94785a39577 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1046

          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58e4b35181486d18 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1047

          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df4d9fe9a1c2a5a0 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1100

          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #883a71c6cb462dad — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1101

          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a2306226596aef5 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1158

          cafile=os.environ.get('SSL_CERT_FILE', certifi.where()),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #485488e748a9b482 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_api_client.py:1159

          capath=os.environ.get('SSL_CERT_DIR'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #257ed18df8884ca3 — Filesystem access.

pkgs/python/[email protected]/google/genai/_api_client.py:1764

      with open(file_path, 'rb') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc6f687fa317154f — Environment-variable access.

pkgs/python/[email protected]/google/genai/_base_url.py:48

    return _default_base_vertex_url or os.getenv('GOOGLE_VERTEX_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b10474d820a1e3f8 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_base_url.py:50

    return _default_base_gemini_url or os.getenv('GOOGLE_GEMINI_BASE_URL')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9872435c445b87f6 — Filesystem access.

pkgs/python/[email protected]/google/genai/_gaos/types/base64fileinput.py:39

            with open(value, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab3c73e72eee0704 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/logger.py:40

    if os.getenv("GOOGLE_GENAI_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #246092bf554c43a7 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:95

    if os.getenv("GOOGLE_GENAI_API_KEY"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f2bbd63a231a4bf — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:96

        security_dict["api_key"] = os.getenv("GOOGLE_GENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fbb6592b20a2b8f — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:98

    if os.getenv("GOOGLE_GENAI_ACCESS_TOKEN"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f55110fa0407f91e — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:99

        security_dict["access_token"] = os.getenv("GOOGLE_GENAI_ACCESS_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7e9a840e4ae40c7 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:101

    if os.getenv("GOOGLE_GENAI_DEFAULT_HEADERS"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86d71a7dca5ca612 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/security.py:102

        security_dict["default_headers"] = os.getenv("GOOGLE_GENAI_DEFAULT_HEADERS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b65180168baa1652 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_gaos/utils/values.py:79

    env_value = os.getenv(env_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #d933633e28c0eaf4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:82

  resp = requests.get(file_url_path)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #c238c5bc4539ce24 — Filesystem access.

pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:111

  with open(file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09d648c4adee5a6c — Filesystem access.

pkgs/python/[email protected]/google/genai/_local_tokenizer_loader.py:128

    with open(tmp_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c064df701f362407 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:223

      os.environ.get('PYTEST_CURRENT_TEST'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2265a87e01e6482 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:315

      self.replays_directory = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92e78ec324c962c3 — Environment-variable access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:315

      self.replays_directory = os.environ.get(
          'GOOGLE_GENAI_REPLAYS_DIRECTORY', None
      )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #782e77490c71f33c — Filesystem access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:359

      with open(replay_file_path, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a0a3537b15ee239 — Filesystem access.

pkgs/python/[email protected]/google/genai/_replay_api_client.py:386

    with open(replay_file_path, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #47b658fc6fb557e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:1827

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #056b31ced21881c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:1906

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2daf6880abf22514 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2001

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cf7c9e4d237f3d3a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2097

    self._api_client.request('post', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #77dfae242ccdab72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2138

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e1b24347f3a113f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/batches.py:2236

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e10f7bc796cd8bf4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1227

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f40389c37d09959f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1309

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #faeb04723d1edf5b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1391

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0d593ea5a60613d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1486

    response = self._api_client.request(
        'patch', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cec2672f4b194019 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/caches.py:1553

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #9b91a88344e0b416 — Environment-variable access.

pkgs/python/[email protected]/google/genai/client.py:215

      default_factory=lambda: os.getenv('GOOGLE_GENAI_CLIENT_MODE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f09e0ef2415c3ba2 — Environment-variable access.

pkgs/python/[email protected]/google/genai/client.py:219

      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAYS_DIRECTORY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e90b22afa119870 — Environment-variable access.

pkgs/python/[email protected]/google/genai/client.py:223

      default_factory=lambda: os.getenv('GOOGLE_GENAI_REPLAY_ID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #2798796362eb3749 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/documents.py:180

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #574493fa49964cdf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/documents.py:258

    self._api_client.request('delete', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #514ca7ff7426ddfc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/documents.py:301

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #8dfc7563a76ab5df — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:380

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #3ea2f7043900a245 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:461

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #11ab894321632b9e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:540

    self._api_client.request('delete', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4346192e403ff845 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:579

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #eb7e9464580c1ec8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:654

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6fd1e4ef9a9138ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/file_search_stores.py:758

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #437163533d2a472c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:221

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c218bf86b72c1f6c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:293

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #9e0a0b17af15dc5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:386

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cac695b1e3a42990 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:466

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2b9f04b40ce08bc2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/files.py:540

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #edcbdd83c93abeee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:4986

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a96e9df259d90c0b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5215

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #770266b80f807146 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5306

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e217f2e6def4e99a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5395

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #beb6f39bb2d50e21 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5479

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4554d1b9a4e3594e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5591

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7253962af268f580 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5694

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #47d3085680a2df18 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5771

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #c8390f12a512d06d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5851

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #e543bf6c9d869fe1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:5936

    response = self._api_client.request(
        'patch', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #48a6b37916ce9ae7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6017

    response = self._api_client.request(
        'delete', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #10efcb0528f3aaa2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6127

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0055b4c95bb1801c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6235

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #476e80e475087145 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/models.py:6327

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #6afad9fd2b7eede6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/operations.py:138

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #a334138dc495094e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/operations.py:189

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d6d2e24e38062ea8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/operations.py:238

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #44c27b46f9a306b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tokens.py:257

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #d40c7343976167e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2490

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #668ae338d6118cef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2567

    response = self._api_client.request('get', path, request_dict, http_options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #53074bf1ae40d71f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2653

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #aa38a39e145582e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2751

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #5b9b21a713c05b66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2844

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #64260e138ce57e4f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/google/genai/tunings.py:2961

    response = self._api_client.request(
        'post', path, request_dict, http_options
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #0e3dafef5a59a735 — Filesystem access.

pkgs/python/[email protected]/google/genai/types.py:9089

    image_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3325a423a7abd4f6 — Filesystem access.

pkgs/python/[email protected]/google/genai/types.py:11474

    video_bytes = pathlib.Path(location).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f70316286fcfa2e — Filesystem access.

pkgs/python/[email protected]/google/genai/types.py:22544

    with open(file_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gunicorn

python dependency

expand_more 104 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #589b4ef91f8336b9 — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:29

bind = os.environ.get("GUNICORN_BIND", "0.0.0.0:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #837cf2b20fda2b6b — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:33

workers = int(os.environ.get("GUNICORN_WORKERS", min(4, multiprocessing.cpu_count() + 1)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6efd898daa9c3278 — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:64

dirty_workers = int(os.environ.get("DIRTY_WORKERS", 9))  # 2+2+4+1 = 9

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b22deae0499be09e — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:67

dirty_timeout = int(os.environ.get("DIRTY_TIMEOUT", 300))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4df835944a231e57 — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:70

dirty_threads = int(os.environ.get("DIRTY_THREADS", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b02c65520b4fc13a — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:73

dirty_graceful_timeout = int(os.environ.get("DIRTY_GRACEFUL_TIMEOUT", 30))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #185729e20d860689 — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:94

loglevel = os.environ.get("LOG_LEVEL", "info")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #88cc5e78402c00f5 — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:151

reload = os.environ.get("GUNICORN_RELOAD", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b470de3a9fa5a456 — Environment-variable access.

pkgs/python/[email protected]/examples/celery_alternative/gunicorn_conf.py:154

preload_app = os.environ.get("GUNICORN_PRELOAD", "false").lower() == "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #df819a03ecf7ee99 — Environment-variable access.

pkgs/python/[email protected]/examples/dirty_example/gunicorn_conf.py:16

bind = os.environ.get("GUNICORN_BIND", "127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #235eae828518ed19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/dirty_example/test_integration.py:30

        with urllib.request.urlopen(url, timeout=10) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #22cbc7612014c6b4 — Environment-variable access.

pkgs/python/[email protected]/examples/dirty_example/test_integration.py:47

    base = os.environ.get("TEST_BASE_URL", "http://localhost:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #eedb69864b6f3108 — Environment-variable access.

pkgs/python/[email protected]/examples/dirty_example/test_stash_integration.py:23

BASE_URL = os.environ.get("TEST_BASE_URL", "http://localhost:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #0bcd67cc87e94282 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/dirty_example/test_stash_integration.py:30

        with urllib.request.urlopen(url, timeout=10) as resp:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #63edd36037bc5990 — Environment-variable access.

pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:11

    base_url = os.environ.get("EMBEDDING_SERVICE_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #1eee1115ea5358b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:15

    response = requests.post(url, json={"texts": ["Hello world"]})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #5fcea899d9599721 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:23

    response = requests.post(url, json={"texts": texts})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #6a2c214d5a7bb2d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/embedding_service/test_embedding.py:29

    response = requests.post(url, json={"texts": ["test", "test"]})

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #cf143e45e24093d2 — Environment-variable access.

pkgs/python/[email protected]/examples/frameworks/django/testing/manage.py:9

    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "testing.settings")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #5f62f6b1a9a91c28 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/frameworks/django/testing/testing/apps/someapp/middleware.py:12

        requests.get('http://requestb.in/15s95oz1')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #b44afb888e42fbc8 — Environment-variable access.

pkgs/python/[email protected]/examples/frameworks/django/testing/testing/wsgi.py:28

os.environ.setdefault("DJANGO_SETTINGS_MODULE", "testing.settings")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a373c97915676249 — Environment-variable access.

pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:19

bind = os.environ.get('GUNICORN_BIND', '0.0.0.0:8443')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2c606402359fb6b4 — Environment-variable access.

pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:23

workers = int(os.environ.get('GUNICORN_WORKERS', multiprocessing.cpu_count() * 2 + 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #feebc75184a3e503 — Environment-variable access.

pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:33

certfile = os.environ.get('GUNICORN_CERTFILE', _default_cert)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #898e2914b47446d7 — Environment-variable access.

pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:34

keyfile = os.environ.get('GUNICORN_KEYFILE', _default_key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #92bfe29279cd0fed — Environment-variable access.

pkgs/python/[email protected]/examples/http2_gevent/gunicorn_conf.py:48

loglevel = os.environ.get('GUNICORN_LOG_LEVEL', 'info')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #e38abc789317c3e1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:67

            response = client.get(f"{self.BASE_URL}/")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #cbcd18d20d0bf639 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:76

            response = client.get(f"{self.BASE_URL}/health")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #893237d4338f6602 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:85

            response = client.post(f"{self.BASE_URL}/echo", content=data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #3cd20d13a6a37d3b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:95

            response = client.post(f"{self.BASE_URL}/echo", content=data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #ab88b203ea7cc367 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:104

            response = client.get(f"{self.BASE_URL}/info")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #b53d9f01015f6db6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:115

            response = client.get(f"{self.BASE_URL}/large")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #8e69b7949edb6f94 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:124

            response = client.get(f"{self.BASE_URL}/stream")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #631dc6af51a39566 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:134

            response = client.get(f"{self.BASE_URL}/delay?seconds=0.5")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #059b943b895529c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:144

            response = client.get(f"{self.BASE_URL}/nonexistent")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #155904b794d544c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:151

            response = client.get(f"{self.BASE_URL}/")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #56d0fe844596045a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:175

                response = client.get(f"{self.BASE_URL}/delay?seconds=0.2")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #01c86b49fdf89696 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:206

                    client.get(f"{self.BASE_URL}/delay?seconds=0.2")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #ea26adaf18b349a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/http2_gevent/test_http2_gevent.py:231

                    client.get(f"{self.BASE_URL}/info")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #5a8e3e089611a97d — Filesystem access.

pkgs/python/[email protected]/examples/read_django_settings.py:13

with open('frameworks/django/testing/testing/settings.py') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2bfbc03ac6b265ea — Filesystem access.

pkgs/python/[email protected]/examples/sendfile.py:16

    f = open(fname, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #377f9eb769a18f7a — Environment-variable access.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:14

    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #e34a90bb9b13680e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:15

    response = requests.get(f"{base_url}/health")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #e630283e6c457b23 — Environment-variable access.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:23

    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #0a5cc1500aa26054 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:25

    response = requests.post(
        f"{base_url}/chat",
        json={"prompt": "hello"},
        stream=True,
        headers={"Accept": "text/event-stream"}
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #4cb0e71473d6aeaa — Environment-variable access.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:56

    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #59cea1ea8f5a2820 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:58

    response = requests.post(
        f"{base_url}/chat/sync",
        json={"prompt": "hello"}
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #acb81a0e9e41d917 — Environment-variable access.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:72

    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #784ea79d237a1770 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:74

    response = requests.post(
        f"{base_url}/chat",
        json={"prompt": "hello", "thinking": True},
        stream=True
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #3fd929dae535f065 — Environment-variable access.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:100

    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #15351e089798ec9d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:106

        response = requests.post(
            f"{base_url}/chat/sync",
            json={"prompt": prompt}
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #3f9c7597c42d184d — Environment-variable access.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:122

    base_url = os.environ.get("STREAMING_CHAT_URL", "http://127.0.0.1:8000")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #7c2c9ab381b0dfbc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/streaming_chat/test_streaming.py:124

    response = requests.post(
        f"{base_url}/chat",
        json={"prompt": "hello"},
        stream=True
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #4dc2b12fe9f97732 — Filesystem access.

pkgs/python/[email protected]/examples/websocket/gevent_websocket.py:445

        data = open(os.path.join(
                     os.path.dirname(__file__),
                     'websocket.html')).read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4aa08dad0d453da — Environment-variable access.

pkgs/python/[email protected]/gunicorn/app/base.py:220

            if os.environ.get('NOTIFY_SOCKET'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8eec92bd495d3f3e — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:54

        os.environ["SERVER_SOFTWARE"] = SERVER_SOFTWARE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16759c0d35c2ea19 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:117

        if 'GUNICORN_PID' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f838c5d049da525f — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:136

                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5afb2503fde831a — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:150

        if 'GUNICORN_PID' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fb42ccf1ee0d58c — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:151

            self.master_pid = int(os.environ.get('GUNICORN_PID'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18cf24b7c8563c61 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:176

                for fd in os.environ.pop('GUNICORN_FD').split(','):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5cded7b837023a8 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:362

            del os.environ['GUNICORN_PID']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a858b43a32d964ff — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:514

                os.environ[k] = self.cfg.env_orig[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eadf30b60f0782ce — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:518

                    del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #205d200921c4d7d0 — Filesystem access.

pkgs/python/[email protected]/gunicorn/arbiter.py:812

            with open(pidfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #704eed11270e0fa1 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/arbiter.py:869

            os.environ['GUNICORN_DIRTY_SOCKET'] = socket_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #586be373036511bd — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:54

        self.env_orig = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20dc57540bf30387 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:231

        if 'SENDFILE' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a33369ad37b9f12 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:232

            sendfile = os.environ['SENDFILE'].lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0ab45f461aadd9f — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:636

    if 'PORT' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79b509460ab84b94 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:637

        default = ['0.0.0.0:{0}'.format(os.environ.get('PORT'))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5064bc06b23756ee — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:690

    default = int(os.environ.get("WEB_CONCURRENCY", 1))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa7b61befa6dfe43 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:1320

    default = os.environ.get("FORWARDED_ALLOW_IPS", "127.0.0.1,::1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9448fd99d376f9ee — Environment-variable access.

pkgs/python/[email protected]/gunicorn/config.py:3138

    xdg_runtime = os.environ.get('XDG_RUNTIME_DIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b93a83488895405 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/ctl/handlers.py:368

            dirty_socket_path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d08fd26c143bd95c — Environment-variable access.

pkgs/python/[email protected]/gunicorn/ctl/handlers.py:530

            dirty_socket_path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76ff87b92aa6c779 — Filesystem access.

pkgs/python/[email protected]/gunicorn/dirty/arbiter.py:242

                with open(self.pidfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30c5a8507c96986d — Environment-variable access.

pkgs/python/[email protected]/gunicorn/dirty/arbiter.py:248

        os.environ['GUNICORN_DIRTY_SOCKET'] = self.socket_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8861e80c67440476 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/dirty/client.py:671

        path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #35a8d2adaeb943c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/gunicorn/dirty/stash.py:360

        result = self._client.get(self._name, key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #4c3a83bfc93824fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/gunicorn/dirty/stash.py:368

        self._client.put(self._name, key, value)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #ba78ec2d4de09cb1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/gunicorn/dirty/stash.py:386

        return self._client.get(self._name, key, default)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #cb113a3ce13e072b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/gunicorn/dirty/stash.py:399

            yield key, self._client.get(self._name, key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #688eeb700f1f2442 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/gunicorn/dirty/stash.py:404

            yield self._client.get(self._name, key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #907d8e2ee41f29de — Environment-variable access.

pkgs/python/[email protected]/gunicorn/dirty/stash.py:429

        path = os.environ.get('GUNICORN_DIRTY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #f4bff8ef02583e4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/gunicorn/dirty/stash.py:453

    _get_client().put(table, key, value)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #888f5cfd3fc16d9a — Environment-variable access.

pkgs/python/[email protected]/gunicorn/dirty/worker.py:152

                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dd5935894e259f2 — Filesystem access.

pkgs/python/[email protected]/gunicorn/glogging.py:205

            self.logfile = open(cfg.errorlog, 'a+')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76a30324fa3112ce — Filesystem access.

pkgs/python/[email protected]/gunicorn/glogging.py:245

                    config_json = json.load(open(cfg.logconfig_json))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5e3729d4e940649 — Filesystem access.

pkgs/python/[email protected]/gunicorn/glogging.py:388

                self.logfile = open(self.cfg.errorlog, 'a+')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18f0a4ca2407c7f7 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/http/wsgi.py:196

    script_name = os.environ.get("SCRIPT_NAME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55d443d8fa230be9 — Filesystem access.

pkgs/python/[email protected]/gunicorn/pidfile.py:56

            with open(self.fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e296287007ea97c — Filesystem access.

pkgs/python/[email protected]/gunicorn/pidfile.py:69

            with open(self.fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c50b2562b99dc8c — Environment-variable access.

pkgs/python/[email protected]/gunicorn/systemd.py:35

    fds = int(os.environ.get('LISTEN_FDS', 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86ce7dc058cd9424 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/systemd.py:36

    listen_pid = int(os.environ.get('LISTEN_PID', 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f8ac1e83ede3e47 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/systemd.py:42

        os.environ.pop('LISTEN_PID', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b54525a66e124179 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/systemd.py:43

        os.environ.pop('LISTEN_FDS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c39441bdb46c880 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/systemd.py:60

    addr = os.environ.get('NOTIFY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efc6200ebfe7ed54 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/systemd.py:75

            os.environ.pop('NOTIFY_SOCKET')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #acc9889544e8b3d4 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/util.py:489

        a = os.stat(os.environ['PWD'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c10b403867dfa58c — Environment-variable access.

pkgs/python/[email protected]/gunicorn/util.py:492

            cwd = os.environ['PWD']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1bf90c85f20ee9ef — Environment-variable access.

pkgs/python/[email protected]/gunicorn/util.py:517

    if 'GUNICORN_FD' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8478792e7d3d5b41 — Filesystem access.

pkgs/python/[email protected]/gunicorn/util.py:607

        with open(path, 'a') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c7fe4c75d206aa7 — Environment-variable access.

pkgs/python/[email protected]/gunicorn/workers/base.py:96

                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx

python dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #9c054cb4345095a2 — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:34

        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da2975781b22035f — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:35

            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6cc19754ddfa491f — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:36

        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: nocover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccbff5a9bfbd5638 — Environment-variable access.

pkgs/python/[email protected]/httpx/_config.py:37

            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

httpx2

python dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #5c0df430fdd07372 — Environment-variable access.

pkgs/python/[email protected]/httpx2/_config.py:34

        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: no cover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b470107ed8891fa — Environment-variable access.

pkgs/python/[email protected]/httpx2/_config.py:35

            ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16f021925c0f6702 — Environment-variable access.

pkgs/python/[email protected]/httpx2/_config.py:36

        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: no cover

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c85c87ea45e3b3ec — Environment-variable access.

pkgs/python/[email protected]/httpx2/_config.py:37

            ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

jiter

python dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #dfb72e77687e8193 — Filesystem access.

pkgs/python/[email protected]/crates/jiter-python/bench.py:22

    CASES[p.stem] = p.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83e291eb65f5e0f1 — Filesystem access.

pkgs/python/[email protected]/crates/jiter/benches/generate_big.py:21

(THIS_DIR / 'big.json').write_text(json.dumps(data, separators=(',', ':')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

katex

python dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #649265ddb432c41f — Filesystem access.

pkgs/python/[email protected]/src/metrics/parse_tfm.py:134

    with open(file_name, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langchain-experimental

python dependency

expand_more 8 low-confidence finding(s)

low env_fs dependency Excluded from app score #1ecafe5e6bb6b334 — Filesystem access.

pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:438

            with open(save_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b114993e9b14b3eb — Filesystem access.

pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:441

            with open(save_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a24c4fe8ea25bf4 — Filesystem access.

pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:462

            with open(load_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9b8df8c1b18e304 — Filesystem access.

pkgs/python/[email protected]/langchain_experimental/data_anonymizer/presidio.py:465

            with open(load_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #c2ca61a95b412b92 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langchain_experimental/graph_transformers/diffbot.py:219

        result = requests.post(url, data=payload)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #074eb87a8969f736 — Filesystem access.

pkgs/python/[email protected]/langchain_experimental/rl_chain/model_repository.py:43

        with open(self.model_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09e3b2132ba4a75e — Filesystem access.

pkgs/python/[email protected]/langchain_experimental/rl_chain/model_repository.py:60

            with open(self.model_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4df0e432a58ca0b — Filesystem access.

pkgs/python/[email protected]/langchain_experimental/rl_chain/vw_logger.py:16

            with open(self.path, "a") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

langchain-text-splitters

python dependency

expand_more 2 low-confidence finding(s)

low egress dependency Excluded from app score #6be8f806818dbe06 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/langchain_text_splitters/html.py:223

            response = client.get(url, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #99d49bbc582f5815 — Filesystem access.

pkgs/python/[email protected]/langchain_text_splitters/html.py:240

            html_content = pathlib.Path(file).read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

llama-index-llms-openai

python dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #9f610e902f39fb09 — Environment-variable access.

pkgs/python/[email protected]/llama_index/llms/openai/utils.py:1039

    openai_api_key = api_key or os.environ.get("OPENAI_API_KEY", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

nano-vectordb

python dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #b732c47b695b67f9 — Filesystem access.

pkgs/python/[email protected]/nano_vectordb/dbs.py:38

    with open(file_name, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f8dc0a44ebd98dd — Filesystem access.

pkgs/python/[email protected]/nano_vectordb/dbs.py:142

        with open(self.storage_file, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc06eeb93a6b9dfb — Filesystem access.

pkgs/python/[email protected]/setup.py:3

with open("./readme.md", "r") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5da3f66c6d177cc — Filesystem access.

pkgs/python/[email protected]/setup.py:9

with open("./nano_vectordb/__init__.py") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b80dc8274c81158 — Filesystem access.

pkgs/python/[email protected]/setup.py:17

with open("./requirements.txt") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

neo4j

python dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #c92aeaa29128267e — Environment-variable access.

pkgs/python/[email protected]/src/neo4j/_debug/_config.py:21

ENABLED = sys.flags.dev_mode or bool(os.getenv("PYTHONNEO4JDEBUG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

networkx

python dependency

expand_more 16 low-confidence finding(s)

low env_fs dependency Excluded from app score #0cad95cd6fd10ad2 — Environment-variable access.

pkgs/python/[email protected]/doc/conf.py:96

os.environ["_NETWORKX_BUILDING_DOCS_"] = "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #69a6e0891fd3e7e4 — Filesystem access.

pkgs/python/[email protected]/examples/external/javascript_force.py:27

json.dump(d, open("force/force.json", "w"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #ce440c16c49c18ef — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/graph/plot_football.py:24

sock = urllib.request.urlopen(url)  # open URL

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #2a8fb8ae9a18b13e — Filesystem access.

pkgs/python/[email protected]/examples/graphviz_layout/plot_lanl_routes.py:22

        fh = open("lanl_routes.edgelist")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #35c911b8f4f1f06b — Filesystem access.

pkgs/python/[email protected]/examples/subclass/plot_printgraph.py:28

            self.fh = open(file, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b113243e25bbd85 — Environment-variable access.

pkgs/python/[email protected]/networkx/conftest.py:47

        backend = os.environ.get("NETWORKX_TEST_BACKEND")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5d498f53c0a3ff5 — Environment-variable access.

pkgs/python/[email protected]/networkx/conftest.py:71

            fallback_to_nx = os.environ.get("NETWORKX_FALLBACK_TO_NX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d9fea153042fcfa — Environment-variable access.

pkgs/python/[email protected]/networkx/lazy_imports.py:75

    if os.environ.get("EAGER_IMPORT", ""):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04e5fd89c625e5da — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:153

            os.environ.get("NETWORKX_CACHE_CONVERTED_GRAPHS", True)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d49becfdcdf3907 — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:155

        fallback_to_nx=bool(os.environ.get("NETWORKX_FALLBACK_TO_NX", False)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #824fcc5f252e6ca4 — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:157

            _comma_sep_to_list(os.environ.get("NETWORKX_WARNINGS_TO_IGNORE", ""))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12084ecf57dd3651 — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:167

        for key, val in os.environ.items()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a968d9aa65a8a3f — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:175

            os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f9418e45bf4e8c9 — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:175

            os.environ.get(
                "NETWORKX_BACKEND_PRIORITY",
                os.environ.get("NETWORKX_AUTOMATIC_BACKENDS", ""),
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #352ac623a4195b91 — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:177

                os.environ.get("NETWORKX_AUTOMATIC_BACKENDS", ""),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c0e663fe0e555f7 — Environment-variable access.

pkgs/python/[email protected]/networkx/utils/backends.py:2152

if os.environ.get("_NETWORKX_BUILDING_DOCS_"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

numpy

python dependency

expand_more 982 low-confidence finding(s)

low env_fs dependency Excluded from app score #4ae5ad0787f20419 — Filesystem access.

pkgs/python/[email protected]/.spin/cmds.py:124

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #031018552fb35630 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:326

    PATH = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16df44af14027229 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:331

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3302356290c8809 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:505

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13005a7dffe98e86 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:523

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08fa9fd82faf3624 — Environment-variable access.

pkgs/python/[email protected]/.spin/cmds.py:547

    env = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15c636fcc715a92b — Filesystem access.

pkgs/python/[email protected]/.spin/cmds.py:629

        with open(local, "wt", encoding="utf8") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #abfb7c065948480c — Filesystem access.

pkgs/python/[email protected]/.spin/cmds.py:632

        with open(pkg_config_fname, "wt", encoding="utf8") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #06f86c014d6dee79 — Environment-variable access.

pkgs/python/[email protected]/benchmarks/benchmarks/__init__.py:12

    if 'SHELL' in os.environ and sys.platform != 'win32':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #33fdcb4b9db3c7e6 — Filesystem access.

pkgs/python/[email protected]/benchmarks/benchmarks/__init__.py:35

        with open(lock_path, 'a+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #70fb023d13b6730f — Filesystem access.

pkgs/python/[email protected]/doc/neps/tools/build_index.py:34

        with open(source) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #432cf9ccab55347a — Filesystem access.

pkgs/python/[email protected]/doc/neps/tools/build_index.py:125

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d4776b7cf7a9a70 — Filesystem access.

pkgs/python/[email protected]/doc/postprocess.py:18

        with open(fn, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2892a756185259e — Filesystem access.

pkgs/python/[email protected]/doc/postprocess.py:24

        with open(fn, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #169af9877b2dd84f — Filesystem access.

pkgs/python/[email protected]/doc/preprocess.py:18

    with open(gen_path, 'w') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8a43c46e48d4c2e — Filesystem access.

pkgs/python/[email protected]/doc/preprocess.py:35

    with open(os.path.join(dsrc_path, "doxyfile")) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2ae0d582ac34356 — Filesystem access.

pkgs/python/[email protected]/doc/preprocess.py:44

            with open(conf_path) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14c82d4706e9df9b — Environment-variable access.

pkgs/python/[email protected]/doc/source/conf.py:247

if os.environ.get('CIRCLE_JOB') and os.environ['CIRCLE_BRANCH'] != 'main':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a28f6d99a4f134db — Environment-variable access.

pkgs/python/[email protected]/doc/source/conf.py:249

    switcher_version = os.environ['CIRCLE_BRANCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b4e1384f24f1666 — Environment-variable access.

pkgs/python/[email protected]/numpy/__init__.py:881

        use_hugepage = os.environ.get("NUMPY_MADVISE_HUGEPAGE", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3a26b849a382e80 — Environment-variable access.

pkgs/python/[email protected]/numpy/__init__.py:913

    if (os.environ.get("NPY_PROMOTION_STATE", "weak") != "weak"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ff35ab332d0d522 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:270

    with open(source) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fe66911e4c66d44 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:320

        fid = open(file, 'r')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14ebcfb0689f5d13 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/conv_template.py:323

        outfile = open(newname, 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d3f64e482fdd7ac — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:8

    with open(init) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #781860562fcf1a52 — Environment-variable access.

pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:89

                os.environ.get('MESON_DIST_ROOT', ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bf200559f267e46 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/gitversion.py:98

        with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1d7ebe5a2561307 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/process_src_template.py:32

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b247e3aeb3bb3c23 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita.py:34

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a622f918541fa6f — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:164

        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48c7abd650778c8b — Environment-variable access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1090

        vars.update(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16064bd870e671d8 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1104

        with open(template_name, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbfe798dee207d63 — Filesystem access.

pkgs/python/[email protected]/numpy/_build_utils/tempita/_tempita.py:1109

        with open(options.output, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a004cb19c56d70f7 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/__init__.py:17

    if envkey not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #022f18f56d1f786c — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/_add_newdocs_scalars.py:60

            machine = os.environ.get('PROCESSOR_ARCHITEW6432', '') \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9ff1b919d327a71 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/_add_newdocs_scalars.py:61

                    or os.environ.get('PROCESSOR_ARCHITECTURE', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #241b09e73f16f815 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/_methods.py:242

        ctx = open(os.fspath(file), "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16dd584c435f2fd9 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:249

        fo = open(filename, 'r')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b2f756383d87af4 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:321

        with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35bee70e62b89b0b — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:325

    with open(filename, 'w') as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33ee00f613ad4e74 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/genapi.py:537

    with open(file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbea4048d6b0fb8c — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/generate_umath.py:1689

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12af4e2d81ed1ec4 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/code_generators/generate_umath_doc.py:20

    with open(target, 'w') as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eadc69077cb7beb1 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/memmap.py:235

            f_ctx = open(
                os.fspath(filename),
                ('r' if mode == 'c' else mode) + 'b'
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4084d94db69d8ca7 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/records.py:901

        ctx = open(os.fspath(fd), 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee7f13b442a38c2a — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/common/pythoncapi-compat/upgrade_pythoncapi.py:608

        with open(filename, encoding=encoding, errors=errors, newline="") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3887c195e3e6164 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/common/pythoncapi-compat/upgrade_pythoncapi.py:627

        with open(filename, "w", encoding=encoding, errors=errors, newline="") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #61da260e4aa2df48 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:85

if 'REPO_NAME' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #5c2f70832dfe4492 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:86

   REPO_NAME = os.environ['REPO_NAME']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #f77c3c21e4606ab3 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:91

if 'current_language' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #4578ba86b1c7507f — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:93

   current_language = os.environ['current_language']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #535b8eee87f6cb8b — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:106

if 'current_version' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #330c52c3ba602a34 — Environment-variable access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/conf.py:108

   current_version = os.environ['current_version']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #af2e780a96b45401 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:59

    data = open(file, 'r').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #c8adff39fdb41a8f — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:73

        with open(ext_file, 'w') as handler:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling reachable #9d89b838eeac55d0 — Filesystem access.

pkgs/python/[email protected]/numpy/_core/src/highway/docs/mm-converter.py:83

            data = open(ext_file, 'r').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb49363ea248e7d0 — Environment-variable access.

pkgs/python/[email protected]/numpy/conftest.py:60

os.environ["NUMPY_EXPERIMENTAL_DTYPE_API"] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77c38b9181103804 — Environment-variable access.

pkgs/python/[email protected]/numpy/conftest.py:100

        os.environ['NPY_AVAILABLE_MEM'] = available_mem

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11e34f9acf7e9278 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/_backends/_meson.py:71

        return self.build_template_path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b6b194c63450cd6 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/_backends/_meson.py:181

        meson_build_file.write_text(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0afedd299f85f608 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/_src_pyf.py:215

    with open(source) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73cd13aa0d2cf6cf — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/auxfuncs.py:920

    with open(source) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f680c1ba98e4249 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/capi_maps.py:158

        with open(f2cmap_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73d1a693ca1e062f — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:318

        with open(filename, 'rb') as fhandle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccbc38a1c2bf9a6a — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:329

    return open(filename, mode, encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #581aab90e951799c — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:3705

                open(l).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26b60e3279ecfc42 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/crackfortran.py:3724

        with open(pyffilename, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4c0ba37bb6102b9 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/f2py2e.py:290

                with open(l):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7c87027e3667b5b — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/f2py2e.py:357

            with open(options['signsfile'], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9119bd82c4767d90 — Environment-variable access.

pkgs/python/[email protected]/numpy/f2py/rules.py:161

generationtime = int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db510b7de7057e37 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1436

    with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1205c92bad697481 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1443

        with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ab63f47a678f987 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1451

        with open(fn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #083d0448c5f04299 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1464

        with open(wn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18c937fb307a14a4 — Filesystem access.

pkgs/python/[email protected]/numpy/f2py/rules.py:1489

        with open(wn, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #eb5fd6497dad27c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/numpy/lib/_datasource.py:333

            with urlopen(path) as openedurl:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #76d0016764bd25c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/numpy/lib/_datasource.py:475

                netfile = urlopen(path)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #62a1000522ca940e — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_format_impl.py:968

        with open(os.fspath(filename), mode + 'b') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ddf28f7ddd1523e — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_format_impl.py:973

        with open(os.fspath(filename), 'rb') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b6f6433e5a87ae6 — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:454

            fid = stack.enter_context(open(os.fspath(file), "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b03093053b04376 — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:568

        file_ctx = open(file, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c28585e97668e4b — Filesystem access.

pkgs/python/[email protected]/numpy/lib/_npyio_impl.py:1549

        open(fname, 'wt').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf82758eefbf8b14 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/clapack_scrub.py:308

    with open(filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfe719c2df138426 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/clapack_scrub.py:318

    with open(outfilename, 'w') as writefo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea54d26822fcfa1c — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/fortran.py:116

    with open(filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a1475540208a47c — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:230

    with open(wrapped_routines_file) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5407f1658bcdd251 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:250

        with open(filename, 'w') as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24072f9b80de0dc0 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:256

    with open(output_file, 'w') as output_fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9eaf9ab2bbec5df — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:258

            with open(r.filename) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16e26dadf3f01260 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:275

    with open(c_file) as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #707c15f9ec9d1544 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:278

    with open(c_file, 'w') as fo:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a10acb738e2896cd — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:301

        with open(fn) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65903a4ad1ec235e — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:309

    with open('f2c.h') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25c4c7ff51e1ee81 — Filesystem access.

pkgs/python/[email protected]/numpy/linalg/lapack_lite/make_lite.py:315

    with open(os.path.join(output_dir, 'lapack_lite_names.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36ce719f747a9e8b — Filesystem access.

pkgs/python/[email protected]/numpy/ma/mrecords.py:626

        f = open(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8df073dafc408b68 — Filesystem access.

pkgs/python/[email protected]/numpy/random/_examples/cffi/parse.py:12

    with open(os.path.join(inc_dir, 'random', 'bitgen.h')) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77a10e9eb6d7a13e — Filesystem access.

pkgs/python/[email protected]/numpy/random/_examples/cffi/parse.py:21

    with open(os.path.join(inc_dir, 'random', 'distributions.h')) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #743aeb507d338cea — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/extbuild.py:209

    with open(cfile.parent / "meson.build", "wt") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99378f1c853e878c — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/extbuild.py:223

    with open(native_file_name, "wt") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17b599fcb0a13914 — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:72

                np_dist.read_text('direct_url.json') or '{}',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2769f1da905ae684 — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:179

            with open(_proc_pid_stat) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57f5042831c4677a — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:208

            with open(_proc_pid_stat) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #017ed4b0ec7522d1 — Environment-variable access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:2711

    env_value = os.environ.get(env_var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #953cf10a268eb5f2 — Filesystem access.

pkgs/python/[email protected]/numpy/testing/_private/utils.py:2763

        with open('/proc/meminfo') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8bdcdea04df0171e — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:57

        with open(self.path, "r") as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #48aad00270ea03e9 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:66

        with open(self.path, 'r') as source:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #30337fafe6ffff9b — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:96

            with open(os.path.join(root, self.clean_path(path)), "w") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a601f230b2c71de5 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:97

                source.write_text(fd)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bf6d6e8128625568 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:101

            with open(
                os.path.join(root, self.clean_path(path) + ".html"), "w"
            ) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #16c5a22b84dc1daf — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:106

        with open(os.path.join(root, 'index.html'), 'w') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #38bb2bb2a31e7fe6 — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:165

        with open(log_file, 'r') as log_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #aabc7b5d593c6b4c — Filesystem access.

pkgs/python/[email protected]/tools/c_coverage/c_coverage_report.py:176

        files.write_text(args.directory)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #aadd01011edf5af0 — Filesystem access.

pkgs/python/[email protected]/tools/check_installed_files.py:108

    with open(os.path.join('build', 'meson-info',
                           'intro-install_plan.json'), 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #34263d3116867fdb — Filesystem access.

pkgs/python/[email protected]/tools/check_openblas_version.py:48

        with open(reqfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bb0d428cf32ec6b1 — Filesystem access.

pkgs/python/[email protected]/tools/check_python_h_first.py:77

    with open(name_to_check) as in_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #94e61b0b0fbb3198 — Filesystem access.

pkgs/python/[email protected]/tools/functions_missing_types.py:101

        with open(module_path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #aac2116c647787b6 — Filesystem access.

pkgs/python/[email protected]/tools/get_submodule_paths.py:12

    with open(gitmodule_file) as gitmodules:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e16b9a5c648afb13 — Filesystem access.

pkgs/python/[email protected]/tools/get_submodule_paths.py:19

    with open(
            os.path.join(root_directory, ".gitattributes"), "r"
    ) as attr_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eac9e7a3b00276e4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:21

        data = json.loads(path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c97a2727c6053f3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:83

        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f0fe78739062e6b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:100

        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d92a5c0e26c33cb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/ci/ciimage/build.py:140

        out_file.write_text(out_data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ee9e6a6ce4d9eea5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/extensions/refman_links.py:128

        raw = Path(self._data_file).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #420f875b9c42bf63 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/genrelnotes.py:71

            snippet = snippetfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #63882872bc9de5e8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/jsonvalidator.py:146

    root_tmp = json.loads(args.doc_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ea4116d9263442d7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorjson.py:115

        self.out.write_text(json.dumps(data), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #020a8bfd2b4c21ff — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorman.py:65

        self.path.write_text(self.text, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #454c15b488ea8d68 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:116

        out_file.write_text(data, encoding='ascii')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #04d001cef94fae21 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:129

            template=template_file.read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #576e96f241fe8a01 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:360

        raw = self.sitemap_in.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #39f2913646b56966 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:371

        self.sitemap_out.write_text(out, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6543e1b9b2fdeb5a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatormd.py:393

        self.link_def_out.write_text(json.dumps(data, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #714b963b9fdb1418 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorvim.py:30

            template=template_file.read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5843bb6ed928f875 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/generatorvim.py:37

        out_file.write_text(result, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fb4b09317285c540 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/loaderbase.py:194

        return f.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #78b7f66724e6a82d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/loaderpickle.py:16

        res = pickle.loads(self.in_file.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #be2765078afa0ac3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/refman/main.py:76

        args.depfile.write_text(out_text, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #81df0397e6c8be02 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/docs/validatelinks.py:16

        async with session.get(url, timeout=timeout) as r:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #ab853c5229f6a805 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/docs/validatelinks.py:24

    with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #6dfa9c5d11a17eec — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/manual tests/4 standalone binaries/build_windows_package.py:14

    response = urllib.request.urlopen(sdl_url, timeout=600.0)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #a2543435ef2807f2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/manual tests/4 standalone binaries/build_windows_package.py:16

    open(sdl_filename, 'wb').write(data)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #205ce7a039bf6ba6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:454

            return open(outfileabs_tmp, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8510485be52585f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:623

            with open(rsp_file, 'w', encoding='utf-8', newline='\n') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fb9361b544cf341 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:727

        with open(exe_data, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b9702c63551828c7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:734

        with open(test_data, 'wb') as datafile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84da098c9097322e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:737

        with open(benchmark_data, 'wb') as datafile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #627064eff739b2c9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:902

        with open(pch_file_tmp, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97491d4bda7344cd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1314

        with open(ifilename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a660367fe1a63e8a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1345

        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0912ac3b85ad83a3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/backends.py:1676

        with open(install_data_file, 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8ed3c317a3bd2c0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:548

                return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da0fe67c97b5d259 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:553

            return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d3acfae32abbbdb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:557

        with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16ad67b4b4ba36f0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:590

                    with open(tempfilename, 'ab') as binfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c127d970f044c5c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:592

                    return open(tempfilename, 'a', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #804549b8e86e12e4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:634

        with open(tempfilename, 'w', encoding='utf-8') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16c36e1fe819e536 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:716

        with open(os.path.join(self.environment.get_build_dir(), 'rust-project.json'),
                  'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #024425b298311006 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:748

            with open(os.path.join(builddir, 'compile_commands.json'), 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8cd98aaae76f4909 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1169

            with open(pickle_abs, 'rb') as p:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b100ee2c012d272 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1174

            with open(pickle_abs, 'wb') as p:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7b5f26c9842b2fb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:1505

        with open(manifest_fullpath, 'w', encoding='utf-8') as manifest:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91baae898f243a91 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:2896

            with open(filename, encoding='ascii', errors='ignore') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c2ade45191e9416 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:3377

                in_file = Path(os.environ['VCToolsInstallDir']) / 'modules/std.ixx'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2eae1f2472ad57b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/ninjabackend.py:3934

        with open(d_file, 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee256bdca4d3f9d1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:36

    vs_version = os.getenv('VisualStudioVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3484a21340f1360b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:37

    vs_install_dir = os.getenv('VSINSTALLDIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cc26e0729ae7835 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:300

        with open(Vs2010Backend.get_regen_stampfile(build_dir), 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ad045cd1b8a0c4a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:304

        has_arch_values = 'VSCMD_ARG_TGT_ARCH' in os.environ and 'VSCMD_ARG_HOST_ARCH' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1dfbd153b3b9d74c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:307

        if 'VCINSTALLDIR' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c2c47e53397967a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:308

            vs_version = os.environ['VisualStudioVersion'] \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2034d31851e9d57 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:309

                if 'VisualStudioVersion' in os.environ else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #868b3a3e26aa6842 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:311

            script_path = os.environ['VCINSTALLDIR'] + relative_path + 'vcvarsall.bat'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4b1412d88515313 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:314

                    target_arch = os.environ['VSCMD_ARG_TGT_ARCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27509815fcad1e3c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:315

                    host_arch = os.environ['VSCMD_ARG_HOST_ARCH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da006ca09d23a07e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:317

                    target_arch = os.environ.get('Platform', 'x86')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d306118a49138426 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:323

        if 'VS150COMNTOOLS' in os.environ and has_arch_values:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18ce84cd4f94b3b8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:324

            script_path = os.environ['VS150COMNTOOLS'] + 'VsDevCmd.bat'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ab5521af9a4751b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:327

                    (script_path, os.environ['VSCMD_ARG_TGT_ARCH'], os.environ['VSCMD_ARG_HOST_ARCH'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a88366cd624102ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:426

        with open(sln_filename_tmp, 'w', encoding='utf-8-sig') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fdb8371839faa10 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:1008

        with open(ofname_tmp, 'w', encoding='utf-8') as of:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9ed35de4cf8de1c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2010backend.py:2110

            with open(rulefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ff01490b4c27c43 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2017backend.py:44

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48a29d76e7b54d5e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2019backend.py:39

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bb913ddf022024c8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2022backend.py:39

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22e6b058320d6161 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/vs2026backend.py:39

        sdk_version = os.environ.get('WindowsSDKVersion', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #758a54da68fde8ce — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/backend/xcodebackend.py:274

        with open(tmpname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #206953be8621b53a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/build.py:3601

        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bef093f5ba86ac7b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cargo/toml.py:41

            with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50b72c1e72b5210d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/executor.py:216

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a307c489b06b63f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:51

        query_file.write_text(json.dumps(query, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ee20af3435e0766 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:75

        debug_json.write_text(json.dumps(index, indent=2), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7941bbaf3347d05b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/fileapi.py:320

        data = json.loads(real_path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40226021dd3e6e67 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/interpreter.py:884

            os_env = environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4db2a4a4fd1f420e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:61

        self.toolchain_file.write_text(self.generate(), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f322a5f9c7847c5e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:62

        self.cmcache_file.write_text(self.generate_cache(), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d72987f591f54aaf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:238

        cmake_file.write_text(cmake_content, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3098dfefa9866ba9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/toolchain.py:242

        temp_toolchain_file.write_text(CMakeToolchain._print_vars(self.variables), encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12e1813dacc05e4c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmake/traceparser.py:170

            trace = self.trace_file_path.read_text(errors='ignore', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b614b3f8e3b882a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmdline.py:93

    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ad3b5a8f291ec57 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/cmdline.py:112

    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c65fe60c55762c9c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:866

                with open(srcname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c4e84f719ae162a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:907

            os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d59d2dd65fbb08ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/compilers.py:1277

        with open(os.path.join(work_dir, sourcename), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa675f927b6e8bdd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:308

            if 'WATCOM' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #562b35304237dd57 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:312

                watcom_cls = [sanitize(os.path.join(os.environ['WATCOM'], 'BINNT', 'cl')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4cd9702800ff91a2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:313

                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT', 'cl.exe')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7a0fdcfecdf2656 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:314

                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT64', 'cl')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd4c28393c4fd267 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:315

                              sanitize(os.path.join(os.environ['WATCOM'], 'BINNT64', 'cl.exe'))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4940cce37b2f74fb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/detect.py:1355

            default_path = os.path.join(os.environ['ProgramFiles'], 'NASM')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b949d3226faa7678 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:228

                    with open(file_to_check, 'rb') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb1f4b823ff97729 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:881

            with open(p.output_name, 'rb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9bcb2203a82ccfa — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/clike.py:1197

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d08b01a5dda09db — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:42

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fce1f09a033e354a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:53

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e29ac928294b5a6f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/elbrus.py:65

        os_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74975b828cfdc634 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/gnu.py:323

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef8840727f1b3828 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/visualstudio.py:316

        if 'INCLUDE' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d25cbe5531520a4f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/compilers/mixins/visualstudio.py:318

        return os.environ['INCLUDE'].split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21abb2f9e6309380 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:292

                    with open(f, encoding='utf-8') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03fb2caa596867fd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:293

                        with open(fcopy, 'w', encoding='utf-8') as wf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #253d676770659e7d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:303

                    os.environ.get('XDG_DATA_HOME', os.path.expanduser('~/.local/share')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d994324c6040bd5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:304

                ] + os.environ.get('XDG_DATA_DIRS', '/usr/local/share:/usr/share').split(':')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ebdab37d16965b11 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/coredata.py:489

    with open(tempfilename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ef16d7984a5f163 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:784

        deploy_target = os.environ.get('MACOSX_DEPLOYMENT_TARGET', macos_version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8dad3ff809cf948 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:800

        deploy_target = os.environ.get('IPHONEOS_DEPLOYMENT_TARGET', ios_version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11715c8d3f77b293 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/blas_lapack.py:939

        _m = os.environ.get('MKLROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #451e2bbf4eb42852 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/boost.py:762

        raw = hfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ec3426e3cc3d655 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:298

        for i in os.environ.get('PATH', '').split(os.pathsep):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #410bf09cc77d75e6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:329

        env_path = os.environ.get(f'{name}_DIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbea3c351cdbeea1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:580

        cmake_txt = importlib.resources.read_text('mesonbuild.dependencies.data', cmake_file, encoding = 'utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c799ea31a2ce10d1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cmake.py:600

        cm_file.write_text(cmake_txt, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d92878d383fea7c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:175

        env_vars = [var for var in env_vars if var in os.environ]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8729ebc1d9a64ffd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:176

        user_defaults = {os.environ[var] for var in env_vars}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15ac046534d7b79b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:182

        return ([(os.environ[self.env_var], True)] if self.env_var else []) \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cad57773b0638a0c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:186

        env_vars = os.environ.keys()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bb8d50ae34f15ef — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:187

        return [(os.environ[var], False) for var in env_vars if var.startswith('CUDA_PATH_')]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81fd59b13516fc94 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:223

            raw = i.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d903351cfd0f0107 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/cuda.py:241

            with open(version_file_path, encoding='utf-8') as version_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #837e6d20c665b140 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/dev.py:777

        vsdir = os.environ.get('VSInstallDir')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9524d4cac0ffac95 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:110

            os.environ[f'HDF5_{cenv}'] = join_args(compiler.get_exelist())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6a77b4ead3a4ca3e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:111

            os.environ[f'HDF5_{lenv}LINKER'] = join_args(compiler.get_linker_exelist())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b2dfe3724158d3e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:114

            del os.environ[f'HDF5_{cenv}']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0afa1ec5e6936a62 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/hdf5.py:115

            del os.environ[f'HDF5_{lenv}LINKER']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f49ae8ab7271cbfb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:54

        tool_names = [os.environ.get(env_name) for env_name in env_vars]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0eed8279147f06f7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:244

        incdir = os.environ.get('MSMPI_INC')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7383a5874a255d8d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:248

            libdir = os.environ.get('MSMPI_LIB32')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66de7a5eeeb3b912 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:251

            libdir = os.environ.get('MSMPI_LIB64')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c529435a30f32692 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/mpi.py:278

        rootdir = os.environ.get('I_MPI_ROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a4ecdad71cffb09 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:164

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bed5a4dec7a72724 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:181

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ece45828c194c782 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:302

        env = env or os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00a7f552acd0bef8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/pkgconfig.py:560

        with open(la_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c600cbf381ff64fb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/python.py:98

            self._data = json.loads(self._path.read_text(encoding='utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #126684a050cfc1e9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/python.py:229

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb693a188a1c0a22 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/scalapack.py:57

        _m = os.environ.get('MKLROOT')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a5130820de314d2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/ui.py:119

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52f2f2d49ad70ecd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/dependencies/ui.py:185

        self.vulkan_sdk = os.environ.get('VULKAN_SDK', os.environ.get('VK_SDK_PATH'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #144f84185e6974c1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/envconfig.py:725

    return os.environ.get('MSYSTEM_CARCH', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a66a79f95bee5714 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/environment.py:70

        value = os.environ.get(var)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39615b8231e0e240 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:385

        if 'MESON_UNIT_TEST' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #864f7963e9789395 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:387

        if 'MESON_RUNNING_IN_PROJECT_TESTS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6611b4a72175166d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:967

        with open(meson_filename, "w", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11d9fdf67fc14a73 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:1250

                ver_data = Path(ifname).read_text(encoding='utf-8').split('\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c7b4c76756d3c44 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:2814

                with open(dst_tmp, 'w', encoding=file_encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b80da6e2ab4cc4d4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreter.py:2821

                with open(depfile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fca2a398589e5515 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreter/interpreterobjects.py:264

        child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b172f4d56d1765c3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106

            with open(fname, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b56b7497167f69b9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155

                    with open(parent / 'meson.build', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c3bdd2783d01479 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676

            with open(option_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #399f44176362edd7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/machinefile.py:30

                with open(fname, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66346addb6aeeeb0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mcompile.py:253

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15a6a3322621a4ab — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mconf.py:95

                    with open(opfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91fcc9def28ad573 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mconf.py:110

                        with open(opfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3659a7ab5c63f19e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:72

    env = {} if dump_fmt else os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #812d183cfaea0a25 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:153

            gdbinit_path.write_text(gdbinit_line, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f5d8125674daa12 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:199

            with open(options.dump, "w", encoding='utf-8') as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d88856177e4ecb99 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:217

        if os.environ.get("MESON_DISABLE_PS1_OVERRIDE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c531e5339ffdbeed — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:219

        shell_env = os.environ.get("SHELL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2bcbc7fada41709 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:233

                args = [os.environ.get("COMSPEC", r"C:\WINDOWS\system32\cmd.exe")]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9caeadee5830e066 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:236

            args = [os.environ.get("SHELL", os.path.realpath("/bin/sh"))]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff59fc9836bdf0ce — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdevenv.py:263

            with open(os.path.join(tmpdir.name, '.zshrc'), 'w') as zshrc: # pylint: disable=unspecified-encoding

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4574e8698e697f57 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:68

    m.update(open(fname, 'rb').read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #754635fb7c67ebd5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:69

    with open(hashname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8485139c9c00c60e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:96

            if 'GITLAB_CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bc86febf559f67a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:261

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b651e3b662043d2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:294

            with lzma.open(xzname, 'wb') as xf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a12c8fcadad527ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:299

            with bz2.open(bz2name, 'wb') as bf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfdd28e6045fb0f7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:304

            with gzip.open(gzname, 'wb') as zf, open(tarname, 'rb') as tf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50b0c537ab4ae17c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mdist.py:324

    myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1812f5439a160b5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesondata.py:21

            data = importlib.resources.read_text( # [ignore encoding] it's on the next lines, Mr. Lint
                    ('mesonbuild' / self.path.parent).as_posix().replace('/', '.'),
                    self.path.name,
                    encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bcad7cb04fcf5e41 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesondata.py:25

            path.write_text(data, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69531361ede93494 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:33

        if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95138fd322cd2305 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:43

        if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbe1bd5000f8dcaf — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:257

    if os.environ.get('MESON_SHOW_DEPRECATIONS'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92b6d7736b0674c3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:264

    if sys.version_info >= (3, 10) and os.environ.get('MESON_RUNNING_IN_PROJECT_TESTS'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b85ef69ea43eb5ad — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mesonmain.py:282

    if sys.platform == 'cygwin' and os.environ.get('MSYSTEM', '') not in ['MSYS', '']:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5c78bc6d14d9a7b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mformat.py:38

            self.read_string(f'[{self.default_section}]\n' + filename.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04ae173605843e79 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mformat.py:1089

                code = src_file.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #602e414f0e77d46e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:545

            destdir = os.environ.get('DESTDIR')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e013654d2937fbc8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:551

            os.environ['DESTDIR'] = destdir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7038052741428aa0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:581

                os.environ.get('MESON_ROOT_CMD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #421e1a85972f45eb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:587

            if rootcmd is None and pkexec is not None and 'PKEXEC_UID' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c8d447214e9a6c0a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:814

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac2d9d3682880498 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:816

            if os.environ.get('SUDO_USER') is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c05651e0dc63169b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:825

            elif os.environ.get('DOAS_USER') is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e5a1760a5f198fa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/minstall.py:879

    with open(os.path.join(log_dir, 'install-log.txt'), 'w', encoding='utf-8') as lf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62967066a09bdd81 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:511

    with open(get_info_file(infodir, kind), encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bc82962f38ffff0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:580

        with open(tmp_file, 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3f76d0af47873d0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mintro.py:650

    with open(tmp_file, 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b510d7025d677e2f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:50

    return bool(kernel.SetConsoleMode(stdout, mode.value | 0x4) or os.environ.get('ANSICON'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9375af242f8d50a8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:52

_in_ci = 'CI' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e26788c4634f127c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:53

_ci_is_github = 'GITHUB_ACTIONS' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #adba631f193ed5dd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:128

        if 'PAGER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c769fcf56b7fdc86 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:129

            pager_cmd = shlex.split(os.environ['PAGER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23e148735bcc5cce — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:148

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0144bfcd8cf4b4e7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:158

            if 'PAGER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5977b5f3766cfb1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:174

        self.log_file = open(os.path.join(logdir, self._LOG_FNAME), 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c20a357649a447b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:175

        self.slog_file = open(os.path.join(logdir, self._SLOG_FNAME), 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b6ce501095db831 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:406

                _colorize_console = os.isatty(output.fileno()) and os.environ.get('TERM', 'dumb') != 'dumb'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d37693171f8db34d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:582

    elif 'MESON_FORCE_SHOW_LOGS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ba5d340553a84d0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mlog.py:589

    with open(fname, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28bbac1e29cb65f2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/_qt.py:817

        with open(fileout_abs, 'w', encoding='utf-8') as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e851f85e0cd866b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/cmake.py:338

            with open(infile, encoding='utf-8') as fin:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #449bc579105e55e3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/cmake.py:352

        with open(outfile_tmp, "w", encoding='utf-8') as fout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c529f408b886268f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/dlang.py:74

            with open(config_path, encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11c26cc93de9ad74 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/dlang.py:115

        with open(config_path, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10e724a903f3561d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/external_project.py:155

        self.run_env: EnvironOrDict = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d68653d7a73d2386 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/external_project.py:220

            output = open(logfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ef85d240a145f34 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/features/module.py:680

        with open(config_path, "w", encoding='utf-8') as cout:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82a6e0bb5e7552e5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/fs.py:169

        with open(file, mode='rb', buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d08cb2fa4d88b298 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/fs.py:268

            with open(path, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a09723e7732f5873 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/gnome.py:950

        with open(gir_filelist_filename, 'w', encoding='utf-8') as gir_filelist:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddb521229cc72628 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/gnome.py:2212

        with open(fname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79d3e2e8fcc58ed0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/hotdoc.py:293

        with open(hotdoc_config_path, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ec7cb4a5a9842ec — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/i18n.py:238

        rsp_file.write_text(source_list, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf7e2872b22e7a30 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/keyval.py:31

            with open(path_to_config, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5fa3dcbf3d55e65 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/pkgconfig.py:555

        with open(fname, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #193bf41105adc5d8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/python.py:431

        with open(pycompile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1fb11bf4ed3356a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/python.py:442

                with open(os.path.join(self.interpreter.environment.get_scratch_dir(), manifest), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2428dd521536913f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/modules/snippets.py:100

        header_path.write_text(content, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b99885c3d141201d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mparser.py:113

        self.in_unit_test = 'MESON_RUNNING_IN_PROJECT_TESTS' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c9a1604d2af58e1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:152

        with open(os.path.join(build_dir, '.gitignore'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0acad7140129018d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:154

        with open(os.path.join(build_dir, '.hgignore'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d3f9be4d7ae52ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/msetup.py:324

                with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e0adba69a471c0d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:527

        self.file = open(filename, 'w', encoding='utf-8', errors=errors)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef1676aa5de5a744 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:762

        inherit_env = env_tuple_to_str(os.environ.items())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e747b4b7a6e9999 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:956

        with open(self.filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19a8c071702b8fc5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1057

        test_only_env = set(self.env.items()) - set(os.environ.items())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e73dc108ee3e7851 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1121

            with open(filename, 'r', encoding='utf8', errors='replace') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3cb3d091dcaf9cd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1794

        return current.env.get_env(os.environ.copy())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76aff214c3ed809b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:1802

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8c4b225409a4e3a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:2237

        with open(targets_file, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e92a15089df29fe — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/mtest.py:2319

            if os.environ.get('MESON_FORCE_BACKTRACE'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7327add2bd20122d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/optinterpreter.py:83

            with open(option_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b650ff5471e1615d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:185

        if 'USERPROFILE' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #472d74a754e74ae5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:196

        appstore_dir = Path(os.environ['USERPROFILE']) / 'AppData' / 'Local' / 'Microsoft' / 'WindowsApps'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4aebc7ab34eb850 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:228

            with open(script, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b2ee3e5937512f5e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:332

        search_dirs = OrderedSet(self._windows_sanitize_path(os.environ.get('PATH', '')).split(';'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18a5b9c52417d78a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/programs.py:354

        path = os.environ.get('PATH', os.defpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2ac89f2fbce4b84 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1022

                with open(fpath, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f39d5a42dda203c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1024

            with open(fpath, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef6788d332675b31 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1075

            with open(val['path'], 'w', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca74727faf7a4621 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/rewriter.py:1144

        with open(options.json, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a9a6137600ff62aa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/clangformat.py:26

            original = fname.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8797de9e111dbf31 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/cleantrees.py:30

    with open(args[0], 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2bdcb775c748a007 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/coverage.py:103

                    with open(llvm_cov_shim_path, 'w', encoding='utf-8') as llvm_cov_bat:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #62d9f9f6fe4d9ae4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/coverage.py:107

                    with open(llvm_cov_shim_path, 'w', encoding='utf-8') as llvm_cov_sh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3bae045b66260c8e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:105

    with open(outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #121c43a1dd66cf1f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:119

    with open(jsonfile, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #64e4e51ce2642f61 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depaccumulate.py:125

        with open(dep, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cdc4a5bd4ed28170 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:159

            self.bf = open(bfile, 'r+b')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bfbe19684dc6890a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:164

                self.bf = open(bfile, 'r+b')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f737bcba1173a3e0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depfixer.py:523

    with open('META-INF/MANIFEST.MF', 'r+', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d509630f1501c00d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:72

        with open(pickle_file, 'rb') as pf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c0bfe2f838813bbf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:90

        for line in fpath.read_text(encoding='utf-8-sig', errors='ignore').split('\n'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e4d9e3a742c48ef4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:134

        for line in fpath.read_text(encoding='utf-8-sig', errors='ignore').split('\n'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8e3fc88e493b26f7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/depscan.py:199

        with open(self.outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #60e5925ef44234cf — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:100

    cppflags = shlex.split(os.environ.get('CPPFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f3e0f4c8308ccd74 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:101

    cflags = shlex.split(os.environ.get('CFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #54c27fedf083bcf2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:102

    cxxflags = shlex.split(os.environ.get('CXXFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9f15e1f21d822ee1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:103

    objcflags = shlex.split(os.environ.get('OBJCFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #432f98d168a8eda7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:104

    objcxxflags = shlex.split(os.environ.get('OBJCXXFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9e06bad81780da7f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:105

    ldflags = shlex.split(os.environ.get('LDFLAGS', ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a195bed9767cf1e8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:278

    with open(tmpfilename, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c12f6653dbbf155d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:329

        compile_args = shlex.split(os.environ.get(compilers.CFLAGS_MAPPING[langname] + envvar_suffix, ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cce23cc93bf11d10 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:331

        cppflags = tuple(shlex.split(os.environ.get('CPPFLAGS' + envvar_suffix, '')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #902b21239d62f4d1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:337

        lang_link_args += shlex.split(os.environ.get('LDFLAGS' + envvar_suffix, ''))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #67689c00bd549ea9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:345

            compilerstr = os.environ.get(envvarname + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #890827dec7190d7d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:365

            binstr = os.environ.get(envvar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4cd5479fb95cf8e8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:371

    var = os.environ.get('PKG_CONFIG_LIBDIR' + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #adf042143e9d092e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:374

    var = os.environ.get('PKG_CONFIG_SYSROOT_DIR' + envvar_suffix)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0066ae878cfb2e39 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/env2mfile.py:523

            with open(pathlib.Path(self.options.outfile) / crossfile_name, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b14cce786a8a829f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:28

        with open(self.depfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7c0ced2222ebf935 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:39

        with open(self.stampfile, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2a670ca5fd738ec8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:74

            output = open(logfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1085239270f3843b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/externalproject.py:79

        run_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0fe4df54c89c6228 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gettext.py:30

        with open(linguas, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #08da12f59fe87ec1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gettext.py:48

    child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #47b66e29fb9ad56c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:52

    env = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d665582ade6eb2cd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:270

    if 'MESON_INSTALL_PREFIX' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a1dabe3bd5b09e37 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:271

        destdir = os.environ.get('DESTDIR', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e3500656cfd4e2bc — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/gtkdochelper.py:272

        install_prefix = destdir_join(destdir, os.environ['MESON_INSTALL_PREFIX'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b4e8220a6a483c9a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/hotdochelper.py:23

    subenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5d2cb759bc13ac38 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/hotdochelper.py:35

        destdir = os.environ.get('DESTDIR', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3a7f7f919e1287f5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/itstool.py:64

    build_dir = os.environ.get('MESON_BUILD_ROOT', os.getcwd())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a8df5ba3c84aecf8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:31

    child_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d2e5dfd8d501fd4a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:49

        stdin = open(exe.feed, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3b553454613cdded — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:84

            with open(exe.capture, 'rb') as cur:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #916a7228452e109d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:89

            with open(exe.capture, 'wb') as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b2c0f32d507a8bab — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/meson_exe.py:106

        with open(options.unpickle, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6f3a6b5271234313 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/msgfmthelper.py:25

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f8279f13d163dd32 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pickle_env.py:6

    with open(args[0], "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5590d74c041f477a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pickle_env.py:7

        pickle.dump(dict(os.environ), f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #418e62617aa69ef4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:12

quiet = int(os.environ.get('MESON_INSTALL_QUIET', 0))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3e85544be6d88038 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:22

        fullpath = absf = os.environ['MESON_INSTALL_DESTDIR_'+key] + f

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0f293a1ab97a37b6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:23

        f = os.environ['MESON_INSTALL_'+key] + f

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #267c1200798dd0d9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/pycompile.py:41

    with open(data_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #536a7893a861c43f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/regen_checker.py:41

    with open(dumpfile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8d1fb7b627d4a4ed — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/regen_checker.py:44

    with open(coredata_file, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #89144ac659c43970 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/reprotest.py:61

        os.environ['CCACHE_DISABLE'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9e7e4a6992618ff1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/run_tool.py:136

    with open('meson-info/intro-targets.json', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d39a54784c5ee478 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/run_tool.py:156

    with open('meson-info/intro-targets.json', encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #347c06f048c3c2ed — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/rustdoc.py:57

                environ = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cee3a26473b11290 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:31

    with open(outfilename, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7bfff653d9c47971 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:36

        with open(outfilename, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #838b47cfb7462eb1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:42

    with open(outfilename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #973cdfa6094aed53 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:53

    with open(TOOL_WARNING_FILE, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3b058273303c9e15 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:58

    if evar in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5f214cde9894e012 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:60

        return shlex.split(os.environ[evar])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #39241de178f583ab — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:118

    origpath = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #24c768969fcebc73 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:120

        os.environ['PATH'] = '/usr/gnu/bin:' + origpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #71721eb88780b909 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:123

        os.environ['PATH'] = origpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d62854de1794c3cf — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:228

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2f859ab613c5f2ed — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/symbolextractor.py:333

            with open(TOOL_WARNING_FILE, 'w', encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1ee43a6b6ab99110 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/uninstall.py:14

    for line in open(log, encoding='utf-8'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e95f3e756f20cde4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:16

    with open(infile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5b5807cf45874888 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:19

        with open(outfile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #dca81e358319b5cd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/vcstagger.py:24

        with open(outfile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #dd5d24a1f696e092 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/scripts/yasm.py:21

    with open(options.depfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #041311ed23834d5b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:96

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8168755e2d19c8e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:100

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #575eef30406475b8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:128

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1220ea564bffacaa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:131

            with open(test_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df84319ab2ddb3f8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:134

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ffc8e02a488d0fe — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:148

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02be2712ba91c579 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:151

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59ec7176922838ad — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:188

            with open(self.source_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b421e6a7841f8d7e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:191

            with open(test_name, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce16d62d813454bf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:194

            with open('meson.build', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a698a0a89bf27bfb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/templates/sampleimpl.py:219

            with open(kwargs['header_file'], 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35a88515c69fd40c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:106

    env_ninja = os.environ.get('NINJA', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7569bce747da4cd7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:193

    if 'SCANBUILD' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #468ad9d045cc3f11 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/tooldetect.py:194

        exelist = split_args(os.environ['SCANBUILD'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #76d6d1db7f1b9bc9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/platform.py:49

                self.lockfile = open(self.lockpath, 'w+', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9defd89626d6070 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/platform.py:98

                self.lockfile = open(self.lockpath, 'w+', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa1304ea868bb4c7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:247

    if 'MESON_COMMAND_TESTS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0de4a7f1f7f30cb7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:752

    arch = os.environ.get('PROCESSOR_ARCHITEW6432', '').lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56754ac1a2bfe482 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:756

            arch = os.environ['PROCESSOR_ARCHITECTURE'].lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d5f21a0cd7bd3bb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:836

    vsver = os.environ.get('VSCMD_VER', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f85abee05c4e05f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1124

        if varname in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65da209265c8ca52 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1126

                num_workers = int(os.environ[varname])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19da8e7193934c46 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1543

        with open(src, encoding=encoding, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7841fc272796e66 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1551

        with open(dst_tmp, 'w', encoding=encoding, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eacb0fba3ca6b4de — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1612

    with open(ofilename_tmp, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #594b9017822700fd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1627

        with open(dst, 'rb') as f1, open(dst_tmp, 'rb') as f2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e810853a49f767ae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:1717

            with open(args_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4cc2357aedabf0f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:2429

        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08750cc883618ffc — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/universal.py:2490

    return int(os.environ.get('MESON_RSP_THRESHOLD', limit))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a9a71082c6e12f0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:31

    if os.environ.get('OSTYPE') == 'cygwin':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0b9c14117f09bf1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:33

    if 'MESON_FORCE_VSENV_FOR_UNITTEST' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e801b8fb873ab7e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:36

        if 'VSINSTALLDIR' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be831c9ee6e1568f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:51

    root = os.environ.get("ProgramFiles(x86)") or os.environ.get("ProgramFiles")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b2d2a2783a1abc1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:98

        with open(env_file.name, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a819ff85e1553cb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/utils/vsenv.py:101

            os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #61b38db8f2b9ca4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:121

        return T.cast('http.client.HTTPResponse', urllib.request.urlopen(req, timeout=REQ_TIMEOUT, context=ssl_truststore()))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2c54c74c986783f2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:172

    with open(wrapfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b4df86b4ed0a250 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:285

        with open(filename, 'r', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39edd6f7dde6214d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:344

            with open(self.get_hashfile(subproject_directory), 'w', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bb8b50a239fc79d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:378

        self.cachedir = os.environ.get('MESON_PACKAGE_CACHE_DIR') or os.path.join(self.subdir_root, 'packagecache')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c7212f60af232867 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:539

                with open(main_fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e98368b9d492e4e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:730

            with open(hashfile, 'r', encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #546e04abac1bb27c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:822

                resp = urllib.request.urlopen(req, timeout=REQ_TIMEOUT, context=ssl_truststore())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #20d7da777bce2b79 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wrap.py:861

        with open(path, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33b9c965049f9e24 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wraptool.py:102

    with open(wrapfile, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13c566971e6a4fc6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/wrap/wraptool.py:207

    with open(os.path.join(subproject_dir_name, 'wrapdb.json'), 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #901f547aa3a07132 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:234

        with open(self.main_xml, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e41a269142cc398 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:237

        with open(self.main_xml) as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #49cc3bdfa831bc62 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createmsi.py:240

        with open(self.main_xml, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21b5ce6e57a65652 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/createpkg.py:94

        with open(self.distribution_file, 'w') as open_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b88ebae4afe0299 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:42

version_lines = pathlib.Path(relfile).read_text().split('\n')[:-1]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b134ac8f45605e3a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:59

    myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da67f3dd8972bb6c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/packaging/mpackage.py:62

    pathlib.Path(relfile).write_text('\n'.join(version_lines) + '\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7f864001b664f823 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_cross_test.py:40

        data = json.loads(cf_path.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7f33798c212f1d7b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_cross_test.py:43

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86f2167f3070ecae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_format_tests.py:19

    lines = file.read_bytes().split(b'\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ca743dc1d862987 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:62

        self.orig_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0c50c8662e867e9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:64

        os.environ['MESON_COMMAND_TESTS'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b09c19c550154b86 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:75

        os.environ.clear()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5c7df06fd981c3a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:76

        os.environ.update(self.orig_env)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2933b69487401d4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:133

        os.environ['PATH'] = str(bindir) + os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb5a68235d196b11 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:151

        os.environ['PYTHONPATH'] = os.path.join(str(pylibdir), '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c9fb7de3931529e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:152

        os.environ['PATH'] = str(bindir) + os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3673f1e29b3b82b0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:163

            os.environ['PYTHONPATH'] = os.pathsep.join(PYTHONPATHS)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2500eefc6f611fe7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:196

        wrapper.write_text('#!/bin/sh\n\nmeson.real "$@"', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71291f2544aab347 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:219

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05f3a10cfd523b76 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_meson_command_tests.py:221

        with open(script_file, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e12c3430cb60d41a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_mypy.py:170

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #158e34aab781ca99 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:278

        self.env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #377d757f82694538 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:310

print_debug = 'MESON_PRINT_TEST_OUTPUT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98ea730c35dfcfcd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:311

under_ci = 'CI' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa727ee79fb0ac68 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:312

raw_ci_jobname = os.environ.get('MESON_CI_JOBNAME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #993e40262ea4f433 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:826

            if skip_env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82d41230a04f3825 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:837

        test_def = json.loads(test_def_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5e633b90e55ad74 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1042

    skip_cmake = ((os.environ.get('compiler') == 'msvc2015' and under_ci) or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5bcd29d48cb8269 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1099

    with open(txtname, 'w', encoding='utf-8', errors='ignore') as lf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef5313337bc7067b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1636

    if 'VSCMD_VER' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7453f3186b2904ec — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_project_tests.py:1637

        print('VSCMD version', os.environ['VSCMD_VER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #deaecb2eae9fae47 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:52

    NINJA_1_12_OR_NEWER = bool(int(os.environ['NINJA_1_12_OR_NEWER']))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67e013099ddcb9dc — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:53

    NINJA_CMD = [os.environ['NINJA']]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #904f3110cb75705d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:63

    os.environ['NINJA_1_12_OR_NEWER'] = str(int(NINJA_1_12_OR_NEWER))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f68c23d28baf3ab1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:64

    os.environ['NINJA'] = NINJA_CMD[0]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93855865b4da65ff — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:72

os.environ['PYTHONWARNDEFAULTENCODING'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffc924f323a378f0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:74

os.environ['MESON_RUNNING_IN_PROJECT_TESTS'] = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #737938a5e0e5eddb — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:118

    if not os.environ.get('MKLROOT', '').strip():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c397bad2b1f28573 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:120

    if (os.environ.get('CC') == 'icl' or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #032844d5f0280868 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:121

            os.environ.get('CXX') == 'icl' or

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99b3ffedcbe84427 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:122

            os.environ.get('FC') == 'ifort'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9626eb56db9f91c7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:131

                 'Please try using the Intel shell.'.format(os.environ.get('MKLROOT')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b60057f051b6a34 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:173

if 'MESON_EXE' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6dcbd2d4518d3d98 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:174

    meson_exe = mesonlib.split_args(os.environ['MESON_EXE'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96a5fa1c02748d9a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:233

            with open(f, encoding='utf-8') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3c18f1f12c5bb1b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:301

    with mock.patch.dict(os.environ, env or {}), mock.patch.object(sys, 'stdout', stdout), mock.patch.object(sys, 'stderr', stderr):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e64d1458c11b633 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:352

    if not mesonlib.is_windows() and not mesonlib.is_haiku() and 'CI' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #26c1c99b1315300e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:366

    if 'APPVEYOR' in os.environ and os.environ['arch'] == 'x86':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79e51d6732ecc329 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:367

        os.environ.pop('platform')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #abb5c1499d4cd965 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_tests.py:370

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86e84ec041faa87c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_unittests.py:69

    os.environ['MESON_UNIT_TEST_BACKEND'] = be

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03c6c6cb45bc56ef — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/run_unittests.py:113

        if 'CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #081993a1cd18b9dd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:13

    if is_pr_env not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbba5c840730ab9c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:16

    elif os.environ[is_pr_env] == 'false':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0a0c4f16eb669de — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:22

    if base_env not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c2e69123614fb91 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/skip_ci.py:25

    return os.environ[base_env]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5b504b1bf6d4ae8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cmake/11 cmake_module_path/subprojects/cmMod/gen.py:1

with open('main.c', 'w') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc62c94c7a878512 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:12

input_file = os.path.join(os.environ['MESON_SOURCE_ROOT'], 'raw.dat')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab64001464f1ba26 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:13

output_file = os.path.join(os.environ['MESON_BUILD_ROOT'], 'generated.h')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6809fef139fe6232 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:15

with open(input_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d596892de3cf5214 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/100 postconf with args/postconf.py:17

with open(output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4d8175f6c324827 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8

with open(output, 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74882c0b1fcb1fac — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:11

        with open(i) as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f84bd9238924af3b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen-resx.py:8

with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8d47ba9b9646c7a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen.py:8

with open(ifile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8d0dfbc1a159cb5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/gen.py:12

with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c7c9425cead8d45 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/109 custom target capture/my_compiler.py:9

    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bedf19dfba480873 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/110 allgenerate/converter.py:8

open(ofile, 'w').write(open(ifile).read())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f2564cf5bad67d1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/123 custom target directory install/docgen.py:14

    with open(os.path.join(out, name + '.html'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #268f1a9382662c6f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/125 configure file in generator/src/gen.py:8

with open(ifile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #725aacfde1ae7ee6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/125 configure file in generator/src/gen.py:12

with open(ofile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2f3c78a6b598cc7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/128 build by default targets in tests/write_file.py:5

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24eb459face7abd9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5

ifile = open(sys.argv[1])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0359e8750e00a80c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6

ofile = open(sys.argv[2], 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42142c9076fa71ae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_custom.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5eecb6c9d38dd1bf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_generator.py:4

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b2c5d72b01a30f1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/13 pch/generated/gen_generator.py:6

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e040ece2c9682362 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_env.py:12

if 'MESONINTROSPECT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b5a4033320dacb6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_env.py:15

mesonintrospect = os.environ['MESONINTROSPECT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94ddb6380cd3ee83 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:8

if 'MESONINTROSPECT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2061062f0d15f6b9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:10

if 'MESON_BUILD_ROOT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86a8fecebe6814fd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:13

mesonintrospect = os.environ['MESONINTROSPECT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3d699cbe994626c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/139 mesonintrospect from scripts/check_introspection.py:16

buildroot = os.environ['MESON_BUILD_ROOT']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df86566a6ad0d5e8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/file_contains.py:14

    with open(args.file[0], encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a35135ff755364c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-deps.py:9

build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e518b0f5549724c5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-deps.py:10

subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4754c9c578a9d98c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-without-input-file.py:9

build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85fcd3d7167a38e8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator-without-input-file.py:10

subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b723bcab9dfd5f25 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator.py:9

build_dir = Path(os.environ['MESON_BUILD_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed17e30c178fff8a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/14 configure file/generator.py:10

subdir = Path(os.environ['MESON_SUBDIR'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #976f39117a39e289 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/140 custom target multiple outputs/generator.py:11

with open(os.path.join(odir, name + '.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e044ef877aea5d7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/140 custom target multiple outputs/generator.py:13

with open(os.path.join(odir, name + '.sh'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1111f825eb54263c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/141 special characters/check_quoting.py:27

    with open(output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8868a6169630ac45 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/144 link depends custom target/make_file.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7855f57b235692c9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/152 index customtarget/gen_sources.py:30

    with open(args.header, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c973f9783b775853 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/152 index customtarget/gen_sources.py:33

    with open(args.code, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45547a2347df3a27 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:41

    proto_name = open(ifile_name).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f6a3a818debfbc2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:45

    open(h_out, 'w').write(h_templ % (proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #832fa4eabba399f5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/168 preserve gendir/genprog.py:46

    open(c_out, 'w').write(c_templ % (proto_name, proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #def223cb027b2a9c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/169 source in dep/generated/genheader.py:15

funname = open(ifile).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88a4955849a775ed — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/169 source in dep/generated/genheader.py:17

open(ofile, 'w').write(templ % funname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4f5c74af994d6fb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/170 generator link whole/generator.py:14

    with open(hname, 'w') as hfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c9b5cacf4b004a0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/170 generator link whole/generator.py:20

    with open(cname, 'w') as cfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4687c9e05110b801 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/178 bothlibraries/dummy.py:7

    Path(sys.argv[1]).write_text('Hello World\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b867510fc0dd830c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/179 escape and unicode/file.py:6

with open(sys.argv[1]) as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4326575d9a58d79 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/179 escape and unicode/file.py:9

with open(os.path.join(sys.argv[3]), 'w', errors='replace') as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f57158cfaa39fae3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/182 find override/subdir/converter.py:13

d = pathlib.Path(ifilename).read_text().split('\n')[0].strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #151af54b9c467d78 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/182 find override/subdir/converter.py:15

pathlib.Path(ofilename).write_text(ftempl % d)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06c121c5de9258a4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/186 test depends/gen.py:7

    with open(sys.argv[1], 'w') as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f47ad8eec059d47 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:41

    proto_name = open(ifile_name).readline().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2f0e84c40c6b679 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:45

    open(h_out, 'w').write(h_templ % (proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41f0e01c96096700 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/195 generator in subdir/com/mesonbuild/tooldir/genprog.py:46

    open(c_out, 'w').write(c_templ % (proto_name, proto_name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e346210442c0cbf9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/202 custom target build by default/docgen.py:11

    with open(os.path.join(out, name + '.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a403c0eb3f628f0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/208 link custom/custom_stlib.py:73

    c_file.write_text(contents)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3f07fbe46537d8c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/209 link custom_i single from multiple/generate_conflicting_stlibs.py:70

        c_file.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0976eb3db9a40520 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/210 link custom_i multiple from multiple/generate_stlibs.py:72

        c_file.write_text(content)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fff033f2b9706f45 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/216 custom target input extracted objects/check_object.py:16

    with open(sys.argv[2], 'wb') as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c9fd9a0c3300ce7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/216 custom target input extracted objects/libdir/gen.py:3

with open(sys.argv[1], 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3acc04f0fd26a66 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/22 object extraction/check-obj.py:12

    with open('compile_commands.json') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75edcb25b1b5821b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/check_arch.py:12

with open(dummy_output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6325397512a92e0a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/make_file.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbfb0f56999e37a2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/226 link depends indexed custom target/make_file.py:7

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #100b30655063c2c7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/227 very long command line/codegen.py:6

Path(sys.argv[2]).write_text(
    'int func{n}(void) {{ return {n}; }}'.format(n=sys.argv[1]))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4dcf55ec0373fc0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2

with open('x.c', 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #612bebdd18eef318 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4

with open('y', 'w'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8f33efab1bbce85 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/242 custom target feed/my_compiler.py:13

    with open(sys.argv[1], 'w+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fa4f999e2773860 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5

assert(Path(sys.argv[1]).read_text() == 'stage1\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #697fdac4f8edd2f3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6

Path(sys.argv[2]).write_text('stage2\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a5a203ecfa45c96 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5

assert(Path(sys.argv[1]).read_text() == 'stage2\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c7d47f3de08dd22 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6

Path(sys.argv[2]).write_text('int main(void){}\n')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a8d925320d800a8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/269 configure file output format/compare.py:3

with open(sys.argv[1], 'r', encoding='utf-8') as f, open(sys.argv[2], 'r', encoding='utf-8') as g:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aefc71806b2ceda7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:5

ENV_VAR_VALUE = os.environ.get('ENV_VAR_VALUE')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81481ddc129b7498 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:8

with open(sys.argv[1], 'r') as infile, \

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #741688bfea411c03 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/271 env in generator.process/generate_main.py:9

     open(sys.argv[2], 'w') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce124d112d33f3f5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/274 customtarget exe for test/generate.py:12

    with open(a, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c458059b41610d99 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/275 environment/testenv.py:9

if os.environ.get(key) == expected:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22bdabce7207bfef — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/275 environment/testenv.py:12

sys.exit(f'Expected {expected!r}, was {os.environ.get(key)!r}')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1801bb842ddcf363 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/33 run program/check-env.py:5

assert os.environ['MY_PATH'] == os.pathsep.join(['0', '1', '2'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99f8b1f3de58c53d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:6

assert os.environ['MESONTESTING'] == 'picklerror'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3471f7240a74227 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:7

assert os.environ['TEST_LIST_FLATTENING'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b079e0271051984 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/41 test args/tester.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e6f6a482e01b53c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/depfile/dep.py:12

with open(output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c829c3ffe8247ebd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/depfile/dep.py:14

with open(depfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a559e086ee23e2a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:11

    assert os.environ['MY_COMPILER_ENV'] == 'value'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee9e9ec27d07493b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:16

    with open(args[1].split('=', 1)[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2fcf0d2fd02ad27 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/49 custom target/my_compiler.py:21

    with open(args[2].split('=', 1)[1], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5dc949e343cdf9d1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler.py:9

    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5325a7ed2483dc38 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler.py:14

    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba32b51989c75b8b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler2.py:9

    with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fef278a2bf44330 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/my_compiler2.py:14

    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15168b29a0696752 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/usetarget/subcomp.py:5

with open(sys.argv[1], 'rb') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f30429874055dfbd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/50 custom target chain/usetarget/subcomp.py:6

    with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf487c803d1d5d9a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:6

assert 'MESON_SOURCE_ROOT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a429bb645881788 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:7

assert 'MESON_BUILD_ROOT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63c515e8d6b9e10f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:8

assert 'MESON_SUBDIR' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #592307a259fd607a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:9

assert 'MESONINTROSPECT' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a20d965be1aeefba — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:10

assert 'MY_ENV' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56261971cacb7533 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:15

env_source_root = Path(os.environ['MESON_SOURCE_ROOT']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2cdc023180a0335 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:16

env_build_root = Path(os.environ['MESON_BUILD_ROOT']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0259ae0bfd89b08 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/check-env.py:17

env_current_source_dir = Path(env_source_root, os.environ['MESON_SUBDIR']).resolve()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b4cb842d2b606f4e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/converter.py:5

with open(sys.argv[1], 'rb') as ifile, open(sys.argv[2], 'wb') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71ffe63b037062bc — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/51 run target/fakeburner.py:9

    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2546d6d360ad6bae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/customtarget.py:12

    with open(os.path.join(args.dirname, '1.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #901768449d47c51d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/customtarget.py:14

    with open(os.path.join(args.dirname, '2.txt'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0edbba293dc3ab7b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:7

prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da47590e62879a71 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:8

dry_run = bool(os.environ.get('MESON_INSTALL_DRY_RUN'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd0800629655f650 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/myinstall.py:30

                with open(os.path.join(dirname, name), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b612d962de0fc7e3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/src/myinstall.py:6

prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #860fc0b9755ebff3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/53 install script/src/myinstall.py:13

with open(os.path.join(dirname, sys.argv[2] + '.in'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6843d9335affe75 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/54 custom target source output/generator.py:10

with open(os.path.join(odir, 'mylib.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbf3748e58037621 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/54 custom target source output/generator.py:12

with open(os.path.join(odir, 'mylib.c'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #268db5846c173a2e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/57 custom header generator/makeheader.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3b73b393824e345 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/57 custom header generator/makeheader.py:11

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ff3f7ecb748ba37 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d99403323084439 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:16

with open(outhdr, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ff612b196abc7ed — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/58 multiple generators/mygen.py:18

with open(outsrc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19386d0545cfe6d9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:13

    with open(infile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a548747bea6253b4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:16

        with open(outfile) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #740e0f97c3923614 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/65 build always/version_gen.py:22

    with open(outfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6c07fbe7dc1d6c3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/69 configure file in custom target/src/mycompiler.py:5

with open(sys.argv[1]) as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81d00c859b0e4e5b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/69 configure file in custom target/src/mycompiler.py:8

with open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #022dd2060496d817 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a5507043f62be16c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:11

with open(sys.argv[2], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1acb295b1731b2c7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9

with open(files[0]) as ifile, open(sys.argv[2], 'w') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #65defdedd8df28f2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/8 install/gendir.py:8

open(fname, 'w').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db3f4ec05ba86708 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/86 private include/stlib/compiler.py:29

with open(cfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb838d38d7884c42 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/86 private include/stlib/compiler.py:31

with open(hfile, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6dad55abfca1490f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/88 dep fallback/subprojects/boblib/genbob.py:5

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2de440b23ef885f6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen.py:21

with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc349ae40f90ccd4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen.py:26

with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82f2aaaac00776fe — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:17

with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a828eece5ed913b5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:22

with open(output_c, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6cf0f8c2db542747 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen2.py:31

with open(output_h, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #148627111cb8fd5c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/90 gen extra/srcgen3.py:12

with open(options.input) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f5ff92bbb8c9cb68 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/92 test workdir/subdir/checker.py:5

data = open(sys.argv[1], 'rb').read()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #331dd275216d1408 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10

with open(sys.argv[1]) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17a8bfd87e3c29cf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43

with open(outc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c214434238fc135c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50

with open(outh, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85352f431de112a4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57

with open(tmpc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e78e61bfc6c62837 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:68

with open(tmpc, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38bea31609ead1cd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:10

input_file = os.path.join(os.environ['MESON_SOURCE_ROOT'], 'raw.dat')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9fc428e8e7640e2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:11

output_file = os.path.join(os.environ['MESON_BUILD_ROOT'], 'generated.h')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3435d388b92b678 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:13

with open(input_file, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c3b0a867712872c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/common/99 postconf/postconf.py:15

with open(output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f854b31bfe3d68ec — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/gen.py:10

with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68f5231d68d7b6ee — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/generator.py:11

with open(args.input) as i, open(args.output, 'w') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #562fcc5d2943bddf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/cython/2 generated sources/libdir/gen.py:10

with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82c47d0570937681 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/39 custom target plainname many inputs/catfiles.py:6

with open(out, 'wb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #585902a7cced9006 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/39 custom target plainname many inputs/catfiles.py:8

        with open(infile, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9c17ba12477f30a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:11

with open(os.path.join(odir, name + '.h'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0510d97d21921815 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:13

with open(os.path.join(odir, name + '.c'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fde83dbbf2ea8e5c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/40 custom target outputs not matching install_dirs/generator.py:15

with open(os.path.join(odir, name + '.sh'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b714f2f8e0db16d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/88 custom target install data/preproc.py:11

with open(outf, 'wb') as o:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e069b1fc69f62bf2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/failing/88 custom target install data/preproc.py:12

    with open(inf, 'rb') as i:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dbd27b8de0695303 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/format/5 transform/file_compare.py:16

    with open(args.actual, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a2c4d6fca918beb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/format/5 transform/file_compare.py:18

    with open(args.expected, 'r') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4489c757179b3bbe — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/fortran/7 generated/gen.py:36

    with open(args.input, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81aa9bec3a8fdb94 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/fortran/7 generated/gen.py:41

    with open(args.output, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4b6e0b242589095 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/10 gtk-doc/include/generate-enums-docbook.py:52

        with open(sys.argv[1], 'w') as doc_out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #acd62d7ba53ae727 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/4 qt/subfolder/generator.py:5

    with open(sys.argv[1], "w") as output:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b29ab0fc3b87f710 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/frameworks/6 gettext/data3/verify.py:12

with open(fname, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2e9543e9cb649ab — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/osx/2 library versions/require_pkgconfig.py:6

if 'CI' in os.environ or shutil.which('pkg-config'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #415b7f681b22d7d3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/python/4 custom target depends extmodule/blaster.py:25

    with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e7bac6467dc1d40 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/python3/4 custom target depends extmodule/blaster.py:26

    with open(options.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1c1b646700e25d9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/rust/11 generated main/gen.py:12

    with open(args.out, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b75de63523309b73 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/rust/19 structured sources/gen.py:12

    with open(args.output, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd61817fa09d0d21 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/2 testsetups/envcheck.py:5

assert 'PATH' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4df716c9bfc11140 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/26 install umask/myinstall.py:6

prefix = os.environ['MESON_INSTALL_DESTDIR_PREFIX']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9faaf2b7fa582102 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/26 install umask/myinstall.py:16

with open(os.path.join(dirname, sys.argv[2]), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3efb84f1d0122bf4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:10

source_root = pathlib.Path(os.environ['MESON_DIST_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8758608238cd3497 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:14

contents = modfile.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1578e6d17875c180 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/replacer.py:16

modfile.write_text(contents)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7053ef016c089767 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/subprojects/sub/dist-script.py:11

source_root = pathlib.Path(os.environ['MESON_PROJECT_DIST_ROOT'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87220c8b9c64c362 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/35 dist script/subprojects/sub/dist-script.py:12

mesonrewrite = shlex.split(os.environ['MESONREWRITE'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df755a52bd649f6e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/45 native dep pkgconfig var/cross_pkgconfig.py:7

environ = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bf163139a1f8937 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:5

assert 'ENV_A' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29438946068d0097 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:6

assert 'ENV_B' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #432873f746686974 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:7

assert 'ENV_C' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a4be5666f541544 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:9

print('ENV_A is', os.environ['ENV_A'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f313a84e89730456 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:10

print('ENV_B is', os.environ['ENV_B'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #203b4d236bf76ce0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/48 testsetup default/envcheck.py:11

print('ENV_C is', os.environ['ENV_C'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b03420ce157ee291 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/67 test env value/test.py:6

assert os.environ['TEST_VAR'] == sys.argv[1]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0667ae127d50baa1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/70 cross test passed/exewrapper.py:15

    defined = 'MESON_EXE_WRAPPER' in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9f985add24f4dd7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/70 cross test passed/exewrapper.py:18

        print(os.environ, file=sys.stderr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2fed3163b0655a6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:5

assert os.environ['MESON_DEVENV'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c474a5fef2280153 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:6

assert os.environ['MESON_PROJECT_NAME'] == 'devenv'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7602dd57e8bf9173 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:7

assert os.environ['TEST_A'] == '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fef5ec9d7a24418a — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:8

assert os.environ['TEST_B'] == '0+1+2+3+4'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #009745dd78b04f69 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/90 devenv/test-devenv.py:9

assert os.environ['TEST_C'] == os.pathsep.join(['/prefix', '/suffix'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffa77bfde83989a6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/94 custominc/easytogrepfor/genh.py:5

f = open(sys.argv[1], 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eed2f3ec18510868 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/98 install all targets/script.py:6

  with open(f, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6852fbe5a5aa304b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/unit/98 install all targets/subdir/script.py:6

  with open(f, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73342b9d5fde0f12 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/vala/10 mixed sources/c/writec.py:11

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #968f4f0216787ee8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/vala/8 generated sources/src/write_wrapper.py:11

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #825435a43723ac39 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/10 vs module defs generated custom target/subdir/make_def.py:4

with open(sys.argv[1], 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cee7f2153fe157f2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/12 resources with custom targets/res/gen-res.py:5

with open(sys.argv[1]) as infile, open(sys.argv[2], 'w') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0679d1628e521b85 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/14 resources with custom target depend_files/ico/gen-ico.py:5

with open(sys.argv[1], 'rb') as infile, open(sys.argv[2], 'wb') as outfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb38efcdd2ff1621 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/test cases/windows/16 gui app/gui_app_tester.py:8

    if 'CI' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bedace72fe1ad487 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/ac_converter.py:362

with open(sys.argv[1], encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #aaa2a02cbeff0263 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:69

    raw = jamroot.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c59119a568e7f39b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:82

    raw = jamfile.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #be167910612d9c8e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/boost_names.py:176

    data = json.loads(meta_file.read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b89cca47eacf6752 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/tools/build_website.py:30

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e70ddb9ceb364d0b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/dircondenser.py:46

    with open(sourcefile, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cb20037053be7899 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/dircondenser.py:50

    with open(sourcefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #eb594b6c6f9d4943 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:23

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3e4010c377732a97 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:121

            with open(output_dir / (cmd+'_'+typ+'.inc'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #90a68262a62950e2 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:125

    url = urlopen('https://wrapdb.mesonbuild.com/v2/releases.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #8b98d3459498b940 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:127

    with open(output_dir / 'wrapdb-table.md', 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #183eccac96ffe855 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/tools/regenerate_docs.py:160

        with open(output_dir/dummy_output_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f8e30043650bbe3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:12

        if v in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67de16ed20735356 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:13

            del os.environ[v]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9fe1beca1b311951 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/__init__.py:16

    os.environ.setdefault('MESON_UNIT_TEST_BACKEND', 'ninja')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cbf356a8b0025a09 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:136

                with open(fin, 'wb') as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5242c7d2344279ca — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:140

                    with open(fout, 'rb') as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f64b83a1662d7c4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:258

                with open(os.path.join(self.builddir, header), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2dcffe92f2c809ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:262

                with open(os.path.join(cmake_builddir, header), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5364202ac9e58cb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:541

        text_log = Path(self.logdir, 'testlog.txt').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b118f9e8177a8f9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:543

        json_log = json.loads(Path(self.logdir, 'testlog.json').read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ca599e0dc4bafe5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:741

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #630009e8fd430233 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:760

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b4e83c48689d688 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:800

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35e69b8448179099 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:805

        with open(os.path.join(self.logdir, 'testlog-valgrind.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f14c7ef681dce595 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:825

        with open(os.path.join(self.logdir, 'testlog-good.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f81bd5bbeea7ebaa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:830

        with open(os.path.join(self.logdir, 'testlog-good.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #742408e14c3edf06 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:866

        with open(os.path.join(self.logdir, 'testlog.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #282849888e0d996b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:871

        with open(os.path.join(self.logdir, 'testlog-mydefault.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba6e9bbb26cb51de — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:876

        with open(os.path.join(self.logdir, 'testlog-other.txt'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1a5809bd3bc16f4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:897

            with open(os.path.join(self.logdir, 'testlog.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2caf03a38ddd3022 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1057

        if mesonbuild.envconfig.detect_msys2_arch() and ('MESON_RSP_THRESHOLD' in os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #97acd9304bb8049b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1122

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3188b93934649367 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1143

            if evar in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1f6ea1343d9fe95 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1156

                        evalue = os.environ.pop(evar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c586f651be38bd4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1237

                    if 'arch' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c24bda98f94aef8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1238

                        if os.environ['arch'] == 'x64':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b625b5c02a1e6e5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1249

                os.environ[evar] = ' '.join(quote_arg(w) for w in wrappercc)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7389965af192009c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1253

                os.environ['AR'] = ' '.join(quote_arg(w) for w in wrapperlinker)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d030740abaa55559 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1268

                del os.environ['AR']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2cd0256fbf251da — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1344

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fd36f08df4fc01ea — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1573

            with open(os.path.join(project_dir, '.hg', 'hgrc'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dee8b3d704298bda — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1613

        with open(os.path.join(path, 'meson.build'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f0c0206c053e14a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1621

            with open(os.path.join(project_dir, 'meson.build'), 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #561e69dd7332a7cc — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1631

            with open(distexe_c, 'w', encoding='utf-8') as ofile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7a1b9978cc11ebf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:1969

                with open(os.path.join(d, 'alexandria.pc'), 'w',
                          encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c41212e0636e4a6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2011

                with open(os.path.join(d, 'alexandriaConfig.cmake'), 'w',
                        encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #833ec39e3c1043b5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2140

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa6369d0875988b6 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2148

        os.environ['PKG_CONFIG_LIBDIR'] = self.privatedir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ea07a8abf641854 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2172

            with open(os.path.join(self.privatedir, name), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5dc0b2ca3338824b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2564

                    with open(os.path.join(tmpdir, 'foo.' + lang), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #008c1608e64c6774 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2570

                    with open(os.path.join(tmpdir, 'Foo.' + lang), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dc6583b97aea904 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2986

        with open(os.path.join(self.builddir, 'nosubst-nocopy1.txt'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1cc03cbd7a6043f1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2988

        with open(os.path.join(self.builddir, 'nosubst-nocopy2.txt'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #966917dea7066439 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:2995

                of = open(mfile, 'w', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54921fe7663fe689 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3215

                            with open(intro_installed_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1396410405d3a8c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3223

        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bd5247018e03647 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3226

        with open(filename, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d0f60bb08d7ab35 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3251

        open(filename, 'w', encoding='utf-8').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #333261a5189fa6b1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3406

            self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c6b817ef71ae333 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3407

                                Path(goodfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40b8c5d905eb5430 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3408

            self.assertNotEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc4685cd9dd60154 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3409

                                Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78ecc526ebdb5f99 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3413

            self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #636ec83d470e9ead — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3414

                                Path(goodfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0bc05e5a45667719 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3415

            self.assertNotEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2ce2c63288d4b13 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3416

                                Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7f7132fe1fce7f5 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3419

            with open(includefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #596e28dee17470f7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3422

            self.assertEqual(Path(testheader).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0054d8385c35a92a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3423

                             Path(goodheader).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba4d979d9f111718 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3465

        self.assertNotEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d8128caef6abae5e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3466

                            Path(fixedfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58d71ea593fb7757 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3471

        self.assertEqual(Path(testfile).read_text(encoding='utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6293c93a127265ba — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3472

                         Path(fixedfile).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc4b602273d59b69 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3523

        with open(os.path.join(infodir, 'intro-targets.json'), encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #331b9b14b0d5ba58 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3657

            with open(curr, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95d82766d94722bf — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3795

            with open(curr, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57256c64bb55bd2c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3805

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1b9c67948149e9f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3820

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13cc34a82ffbbf2f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3838

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6498ba572497dc97 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:3849

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe3f6b0c25196e64 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4279

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6cb167614a7063b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4296

        with open(doc_path, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1283b8cac51f8c1e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4499

            with open(os.path.join(srcdir, 'subprojects', 'wrap_git.wrap'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e3c0bea82542e23 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4516

            with open(os.path.join(srcdir, 'subprojects', 'wrap_git.wrap'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29cdf7f664ae85ad — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4553

        with open(machinefile, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #355c7bb8c7fbbe8b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4582

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62671ed53320548b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4591

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b07b5aaa493088b8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4600

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6ed1ea62cc05ddd — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4609

        with open(redirect_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8be06dbd8028926 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4614

        with open(real_wrap, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdd3fdb6a6a4ca52 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4741

        o = Path(fname).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05fa9aad76224ee8 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4800

        with mock.patch.dict(os.environ, {'CFLAGS': '-DCFLAG', 'LDFLAGS': '-flto'}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d16ac9c35a21254e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:4991

        with open(introfile, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd1b99d64cfd0fb7 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5324

        with open(gen_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0aa933dc9a50cf31 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5332

        with open(gen_file, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8e228287950ddfb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5409

        olddata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #caf712712a2d6e53 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5414

            newdata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d9f3fdaa85780d6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5423

            newdata = filename.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53d68bef80fa2a1f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5585

        with open(os.path.join(testdir, 'mod1.f90'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cbdb6957fd7e4b3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/allplatformstests.py:5595

        with open(os.path.join(testdir, 'test.f90'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d546ad52229ed7b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:72

        cls.backend_name = os.environ.get('MESON_UNIT_TEST_BACKEND', 'ninja')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b2beba078dcc549 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:107

        cls.env_patch = mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0dd90c39c1625f7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:110

        os.environ['COLUMNS'] = '80'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f933423bc10dd589 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:111

        os.environ['PYTHONIOENCODING'] = 'utf8'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39096c6282ad0fce — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:120

        if (is_windows() or is_cygwin()) and not os.environ.get('MESON_FORCE_UNITTEST_IN_TMP', '0') == '1':

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7031f8d41c7812e0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:160

        return open(log, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #320db680c6de66a0 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:186

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5defc834063df11c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:290

            with mock.patch.dict(os.environ, override_envvars):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1735d4f2981453aa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:341

            with open(os.path.join(self.builddir, 'compile_commands.json'), encoding='utf-8') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05b0acb0c26c66a4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/baseplatformtests.py:355

                with open(rsp, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a8ffb9b83138754 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:188

            with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c21430df13934dfe — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:328

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24a3b9a8b1cad22a — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:346

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc69eedc60e7c4f9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:360

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b718454f57ef2023 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:397

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9f8cc344ec1931e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:414

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a68f602087ea929 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:438

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e435410597665413 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:454

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90958b93ce3daa0f — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:494

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e38c662588e273fc — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:512

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #deff380a1e966644 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:546

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aee64b0bca7674e9 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/cargotests.py:566

            with open(fname, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9880feecde6a797 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/darwintests.py:59

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a5982a1ecb3c324 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/darwintests.py:70

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b5fcf7e23372a38 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:71

        with open('docs/markdown/Builtin-options.md', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51adb6237776c173 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:105

        with open('docs/markdown/Builtin-options.md', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98bfa0ee6e937b34 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:176

        with open("docs/markdown/Reference-tables.md", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50475f615784bca0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:192

        with open("docs/sitemap.txt", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f81bec347196d24 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:206

        with open("docs/theme/extra/templates/navbar_links.html", encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28b66d28ac2c71b9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:218

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df5c9674ef48786c — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:228

        del os.environ['MESON_RUNNING_IN_PROJECT_TESTS']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23cc4024c6398b9c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:231

        with open('data/syntax-highlighting/vim/syntax/meson.vim', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58b29a734baf9ea5 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:236

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a9c3d710236eaba — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/datatests.py:246

        del os.environ['MESON_RUNNING_IN_PROJECT_TESTS']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d3ded590d4ac921 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:93

        with open(self.mbuild, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67baaac0168c749d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:102

            with open(self.moptions, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed196e1d1581d707 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/failuretests.py:119

        with open(self.mbuild, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2797a942cd6da128 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/featurestests.py:85

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91771c1eb7ecc596 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/featurestests.py:96

        os.environ.pop('MESON_RUNNING_IN_PROJECT_TESTS', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a795bde853de952 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:34

IS_CI = os.environ.get('MESON_CI_JOBNAME', 'thirdparty') != 'thirdparty'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f604b6a1dde7bde7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:211

            if not IS_CI and key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91b57dc4cd251067 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:213

            with mock.patch.dict(os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79bde2c3178066f1 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:214

                os.environ.pop(key, None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e555d466ce587148 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/helpers.py:301

    if os.environ.get('MESON_CI_JOBNAME') == name:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #836ea6c2caba484b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:727

            script_path.write_text('import sys\nprint(sys.argv[1])\n', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10eaa4c0ba97fdf2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:1081

        with open('data/test.schema.json', 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #365cc6dbbf228185 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/internaltests.py:1092

                schema_validator(json.loads(p.read_text(encoding='utf-8')))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b92d4b1db01b7a56 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:42

PKG_CONFIG = os.environ.get('PKG_CONFIG', 'pkg-config')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f58eb895fb5286a2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:58

    pkgconf = os.environ.get('PKG_CONFIG_PATH')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2416fb14e8b7455 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:156

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b568d6e3b53fe757 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:168

        os.environ['PKG_CONFIG_LIBDIR'] = self.privatedir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4c14a2587c18c10 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:224

        with open(os.path.join(privatedir2, 'dependency-test.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #790d145fb0685d93 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:255

        with open(os.path.join(privatedir1, 'simple2.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53c9856627bbff08 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:260

        with open(os.path.join(privatedir1, 'simple3.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b39ee7744804be4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:264

        with open(os.path.join(privatedir1, 'simple5.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #707e4086a0a68263 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:268

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61ca8adc4c9eed06 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:274

        os.environ['PKG_CONFIG_LIBDIR'] = os.path.join(self.builddir, 'meson-uninstalled')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43219ab59f5fe749 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:276

            os.environ['PATH'] += os.pathsep + self.builddir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a04fc0c3fb02d602 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:287

        with open(os.path.join(self.privatedir, 'somename.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1babfbd7026beedd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:824

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1dc9853a4215cab0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:849

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as ifile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de51647526ab1506 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1132

            myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bfb0bbb7cd433ac3 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1143

            myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eff3ed012fdba940 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1272

        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02cd833cf51722cd — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1287

        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5204c3b75b3a9f07 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1300

        myenv = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #abd97c37300aa959 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1312

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b35115f123636ffa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1331

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24a543cb7f64363e — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1344

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80d7b7c0d6f7c046 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1430

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as bfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0dfe6be58b779f59 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1495

                os.pathsep + os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31fcc874355bffa0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1545

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54139edd084e8ad8 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1554

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #68c67917323024e9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1653

            with mock.patch.dict(os.environ, {envvar: name}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddd546f2a87df955 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1704

        with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bcba36c6775fdfd0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1728

        with open(wrap_filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a7ce51daa1fd68b0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1756

            with open(os.path.join(d, 'meson.build'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b53feca85ef7110 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1767

        with open(os.path.join(self.privatedir, 'bar1.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b13d8387d7483b3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1770

        with open(os.path.join(self.privatedir, 'bar2.pc'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4620d39ffd838080 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/linuxliketests.py:1888

        with open(os.path.join(self.builddir, 'build.ninja'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #633c152a42be7946 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:80

                home = PurePath(os.environ['HOME'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73327b93434a9a2d — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:84

                if 'USER' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0961890b47f0a596 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:86

                home = PurePath('C:\\', 'Users', os.environ['USER'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c33d3139525ea20 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:112

        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9269e399638d4d59 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:134

        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab519965053d92bb — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:172

        with open(batfile, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46930b9ca80c16ce — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:206

                with open(fifo, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c00bb5b3d8fba73 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:793

    @skipIf('MESON_EXE' in os.environ, 'MESON_EXE is defined, cannot use mocking.')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce35da98ed9540b2 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:808

                with mock.patch.dict(os.environ, {'XDG_DATA_HOME': d}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44e380000d8c09af — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:813

                with mock.patch.dict(os.environ, {'XDG_DATA_DIRS': d}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7d4d5196f90dc301 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:814

                    os.environ.pop('XDG_DATA_HOME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ee4122a6df8d88f — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:829

                with mock.patch.dict(os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9412cf3f39d5820b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:830

                    os.environ.pop('XDG_DATA_HOME', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b3168dfd245eaa2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:843

        with open(filename, 'wt', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c4a89e8afd1772e — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/machinefiletests.py:943

                    del os.environ[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dec3e6061c956bf4 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:104

                with open(os.path.join(self.builddir, 'meson-info', 'intro-targets.json'), 'r', encoding='utf-8') as tgt_intro:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #b0eb27109005b187 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:141

            with urllib.request.urlopen('https://wrapdb.mesonbuild.com') as p:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #589689cee5ce24b6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:174

        with open(os.path.join(testdir, 'test.json'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54ef7135932158ae — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:295

        with open(os.path.join(self.builddir, 'meson-logs', 'profile-startup-modules.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9cc57df8aa7a2aad — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:298

        with open(os.path.join(testdir, 'expected_mods.json'), encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0da0eb1be8df9978 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:387

        with open(editorconfig, 'w', encoding='utf-8') as handle:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5a24cb8552d37ef — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:453

        with open(os.path.join(testdir, 'meson_options.txt'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90aa5c4beeef8221 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:462

        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f17ecbe9fcaca2ee — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:464

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1295294ea2a8d54c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:487

        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ca1f75bc9481ea1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:489

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45765a03d85a8bd0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:502

        with open(os.path.join(testdir, 'meson_options.txt'), 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8912266809558089 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:504

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #378d4231b7ccf0ec — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:527

        with open(os.path.join(testdir, 'meson.options'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f7fe148f7460e9b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:536

        with open(os.path.join(testdir, 'meson_options.txt'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d7a90cd77d102ee — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:545

        with open(os.path.join(testdir, 'subprojects/subproject/meson_options.txt'), 'a', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b32e9eecb537ca3 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:600

            Path(d, 'bar.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24afa23f1959e57b — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:605

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e0889954a65379d — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:612

            Path(d, 'bar.c').write_text('int bar() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00d9cd6e3c29e089 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:613

            Path(d, 'foo.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #679e79d0768e6d21 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:617

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2ac5c1ffa874fe2 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:624

            Path(d, 'bar.c').write_text('int main() {}', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3560d2e9dd471945 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:629

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eadcab38cc2ea8c6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/platformagnostictests.py:640

            meson_build = Path(d, 'meson.build').read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21b0f0d0a1e047d0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/pythontests.py:45

            mesonfile.write_text('''project('test', 'c', version: '1')
pymod = import('python')
python = pymod.find_installation('python3', required: true)
''', encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f1f456e6eeb3c63 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/rewritetests.py:485

        original_contents = meson_build_file.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47390f31ad6bb056 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/rewritetests.py:531

        expected = Path(test_path / "expected_dag.txt").read_text(encoding='utf-8').strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4451ca04849ea2c6 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:35

        with open(str(path / 'meson.build'), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc1645bb2f911cb0 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:97

        with open(str((self.subprojects_dir / name).with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77921c20de37afe1 — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:112

        with open(str((self.subprojects_dir / name).with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28bafe3be73ff99c — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/subprojectscommandtests.py:260

        with open(str((self.subprojects_dir / 'redirect').with_suffix('.wrap')), 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24e89651390df257 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:49

    @mock.patch.dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c71ddda923c87be4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:78

        os.environ['PATH'] += os.pathsep + testdir

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0658e5e2227aecb9 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:80

        if '.PY' in [ext.upper() for ext in os.environ['PATHEXT'].split(';')]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2caa3dd41d559f7 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:104

        path = os.environ['PATH']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffb03fea613fe071 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:106

            username = os.environ['USERNAME']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bc140dc60b07c94 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:240

            current_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1da5c2eccc875bf4 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:296

            with mock.patch.dict(os.environ, {envvar: name}):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ae1235407e876fa — Filesystem access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:382

        with open(build_ninja, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d03a4b3d7511bba — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:441

        if 'VSCMD_VER' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d654512fdad5ba99 — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:443

        if version_compare(os.environ['VSCMD_VER'], '<16.10.0'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6ba078b2b46631b — Environment-variable access.

pkgs/python/[email protected]/vendored-meson/meson/unittests/windowstests.py:466

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ollama

python dependency

expand_more 12 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #e41e517d5eee852d — Filesystem access.

pkgs/python/[email protected]/examples/generate-image.py:13

    with open('output.png', 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #24e3bcf691afb402 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/multimodal-generate.py:8

latest = httpx.get('https://xkcd.com/info.0.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #29d200881fe536d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/multimodal-generate.py:13

comic = httpx.get(f'https://xkcd.com/{num}/info.0.json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #51c53e4f26676fe9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/multimodal-generate.py:20

raw = httpx.get(comic.json().get('img'))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #dcb287041fcaea42 — Environment-variable access.

pkgs/python/[email protected]/ollama/_client.py:108

    api_key = os.getenv('OLLAMA_API_KEY', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc606c65ecc8e228 — Environment-variable access.

pkgs/python/[email protected]/ollama/_client.py:113

      base_url=_parse_host(host or os.getenv('OLLAMA_HOST')),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #de0e3ff17b2883fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/ollama/_client.py:139

      r = self._client.request(*args, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #4173c936e7067254 — Filesystem access.

pkgs/python/[email protected]/ollama/_client.py:611

    with open(path, 'rb') as r:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59786e84f161cb95 — Filesystem access.

pkgs/python/[email protected]/ollama/_client.py:620

    with open(path, 'rb') as r:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #0dde7ec726c83b9d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/ollama/_client.py:732

      r = await self._client.request(*args, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #616cea5f931469cd — Filesystem access.

pkgs/python/[email protected]/ollama/_types.py:167

      return b64encode(self.value.read_bytes() if isinstance(self.value, Path) else self.value).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b68b1a5f1b7df6e — Filesystem access.

pkgs/python/[email protected]/ollama/_types.py:172

          return b64encode(Path(self.value).read_bytes()).decode()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

python dependency

expand_more 69 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #2cee78600197c6cf — Filesystem access.

pkgs/python/[email protected]/examples/image_stream.py:30

            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2261754d0a1a761d — Filesystem access.

pkgs/python/[email protected]/examples/image_stream.py:41

            with open(filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6ae773ddbf2ffdf4 — Environment-variable access.

pkgs/python/[email protected]/examples/realtime/azure_realtime.py:31

    endpoint = os.environ["AZURE_OPENAI_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #31093b723ebafea9 — Environment-variable access.

pkgs/python/[email protected]/examples/realtime/azure_realtime.py:37

    deployment_name = os.environ["AZURE_OPENAI_DEPLOYMENT_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #85efd09954ab3718 — Filesystem access.

pkgs/python/[email protected]/examples/uploads.py:30

    data = file.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23db92d348f0a691 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:158

api_type: _ApiType | None = _t.cast(_ApiType, _os.environ.get("OPENAI_API_TYPE"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ebef4ea6646f771b — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:160

api_version: str | None = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0982afd59e5a3dd — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:162

azure_endpoint: str | None = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64f7e61358fa9366 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:164

azure_ad_token: str | None = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2991e64ad0219b68 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:338

    return _os.environ.get("OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee60c064e9839730 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:342

    return azure_endpoint is not None or _os.environ.get("AZURE_OPENAI_API_KEY") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1de994e414eda8b — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:347

        _os.environ.get("AZURE_OPENAI_AD_TOKEN") is not None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20f112fb6bbd9e61 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:363

            azure_endpoint = _os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b38416347bf552ea — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:366

            azure_ad_token = _os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #101f749dedefc62e — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:369

            api_version = _os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f69391da37bbd006 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:379

            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5c940de0e07d987 — Environment-variable access.

pkgs/python/[email protected]/src/openai/__init__.py:379

            if (azure_ad_token is not None or azure_ad_token_provider is not None) and _os.environ.get(
                "AZURE_OPENAI_API_KEY"
            ) is not None:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #b16eec9aef484dd7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/_base_client.py:309

        return await self._client.request(self._page_cls, self._options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #235ee71e1e849c5f — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:209

                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14dde31827d953c5 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:219

            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99c02eba05e2ede9 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:235

            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9b3438a13d6891a — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:239

            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9138d0b0625bfe8c — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:243

            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94a0d8150fcd5773 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:251

            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ede9ba6e5dc78b6f — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:255

        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8d1292435fa9639 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:805

                api_key = os.environ.get("OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75dfd198abc83fbf — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:815

            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5134672e62d2e6d3 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:831

            organization = os.environ.get("OPENAI_ORG_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #081fde9cff3394b5 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:835

            project = os.environ.get("OPENAI_PROJECT_ID")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53abed859960466d — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:839

            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb8c5a3f1d733eea — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:847

            base_url = os.environ.get("OPENAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20ca174fb7e6fb47 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_client.py:851

        custom_headers_env = os.environ.get("OPENAI_CUSTOM_HEADERS") if provider_runtime is None else None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e148dc9702cec8a — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:69

            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #857f3b020d9ec891 — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:81

        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #799ea3fe7df06108 — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:111

            return (path.name, await path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fc308f3d7f24364 — Filesystem access.

pkgs/python/[email protected]/src/openai/_files.py:123

        return await anyio.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f0524856c129ccc — Filesystem access.

pkgs/python/[email protected]/src/openai/_legacy_response.py:441

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f783791b19ce0a98 — Filesystem access.

pkgs/python/[email protected]/src/openai/_legacy_response.py:454

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d5b4a143cbfd8d0 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_models.py:129

            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83d4faac0112397f — Filesystem access.

pkgs/python/[email protected]/src/openai/_response.py:513

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de0418e941a0a45f — Filesystem access.

pkgs/python/[email protected]/src/openai/_response.py:555

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6af9cd8d7b2b8d5 — Environment-variable access.

pkgs/python/[email protected]/src/openai/_utils/_logs.py:23

    env = os.environ.get("OPENAI_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f5a1390fa623699 — Filesystem access.

pkgs/python/[email protected]/src/openai/_utils/_transform.py:248

            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5904237550cb3e6 — Filesystem access.

pkgs/python/[email protected]/src/openai/_utils/_transform.py:414

            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33b44ea8712c59ea — Filesystem access.

pkgs/python/[email protected]/src/openai/_utils/_utils.py:383

    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff69992fc3fc53f5 — Filesystem access.

pkgs/python/[email protected]/src/openai/auth/_workload.py:58

            with open(token_file_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #3300b093dc4e2ae5 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:106

                response = http_client.get(url, params=params, headers={"Metadata": "true"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #0fc7ecb88b78683a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:109

                    response = client.get(url, params=params, headers={"Metadata": "true"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #668e32482bd15114 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:153

                response = http_client.get(url, params=params, headers={"Metadata-Flavor": "Google"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #048b8dc17ed5435f — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:156

                    response = client.get(url, params=params, headers={"Metadata-Flavor": "Google"}, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #38dd4069d82d579a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/src/openai/auth/_workload.py:249

            response = client.post(
                self.token_exchange_url,
                json={
                    "grant_type": TOKEN_EXCHANGE_GRANT_TYPE,
                    "subject_token": subject_token,
                    "subject_token_type": subject_token_type,
                    "identity_provider_id": self.workload_identity["identity_provider_id"],
                    "service_account_id": self.workload_identity["service_account_id"],
                },
                timeout=10.0,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #e93baa59a02d46c3 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/_bedrock_auth.py:172

        region = os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6ea0893dcc2988b — Filesystem access.

pkgs/python/[email protected]/src/openai/lib/_validators.py:485

                with open(fname, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5ce04dafab01b5b — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:214

            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #911ae3b9ed66484c — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:217

            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64feb2a397493b7c — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:225

            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c9752091c6609f3 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:239

                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4851279e0c508d3 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:538

            api_key = os.environ.get("AZURE_OPENAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e8292d7abc8f1db — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:541

            azure_ad_token = os.environ.get("AZURE_OPENAI_AD_TOKEN")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2ec9312347e354e — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:549

            api_version = os.environ.get("OPENAI_API_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c96e9e74fdf1fe6 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/azure.py:563

                azure_endpoint = os.environ.get("AZURE_OPENAI_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94909d4e892ef963 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:70

    configured = region or os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #416d3938b6991adb — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:80

    environment_base_url = os.environ.get("AWS_BEDROCK_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a9f14b70a8681b2 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:105

    token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12845f655cd0a145 — Environment-variable access.

pkgs/python/[email protected]/src/openai/lib/bedrock.py:150

    environment_token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8437981776882d78 — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:248

            token = os.environ.get("AWS_BEARER_TOKEN_BEDROCK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a4813e7e9bc95bd — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:331

            os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3888aef17a304add — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:338

        environment_base_url = _normalize_optional_string(os.environ.get("AWS_BEDROCK_BASE_URL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a0329fdaf89f0a3 — Environment-variable access.

pkgs/python/[email protected]/src/openai/providers/bedrock.py:391

        and bool(os.environ.get("AWS_BEARER_TOKEN_BEDROCK"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openpyxl

python dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #fe0e7c9e46fc2b36 — Filesystem access.

pkgs/python/[email protected]/openpyxl/worksheet/_writer.py:379

        with open(self.out, "rb") as src:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21181130e9689bd7 — Environment-variable access.

pkgs/python/[email protected]/openpyxl/xml/__init__.py:23

    return os.environ.get("OPENPYXL_LXML", "True") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14428c76c725e084 — Environment-variable access.

pkgs/python/[email protected]/openpyxl/xml/__init__.py:39

    return os.environ.get("OPENPYXL_DEFUSEDXML", "True") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23053724ca77c612 — Filesystem access.

pkgs/python/[email protected]/setup.py:24

    with open(os.path.join(here, 'README.rst')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

opensearch-py

python dependency

expand_more 14 low-confidence finding(s)

low env_fs dependency Excluded from app score #45f5026a6093341c — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/_async/helpers/test.py:17

OPENSEARCH_URL = os.environ.get("OPENSEARCH_URL", "https://localhost:9200")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #1f1dc96dcf6faa8c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/opensearchpy/_async/http_aiohttp.py:294

            async with self.session.request(
                method,
                url,
                data=body,
                headers=req_headers,
                timeout=timeout,
                fingerprint=self.ssl_assert_fingerprint,
            ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #fa637873893978fa — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/connection/base.py:100

        if os.getenv("ELASTIC_CLIENT_APIVERSIONING") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a5fee8420f635ce — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/connection/base.py:329

        ca_certs = os.environ.get("SSL_CERT_FILE") or os.environ.get("SSL_CERT_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #fd101a1a6cb7a711 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/opensearchpy/connection/http_async.py:233

            async with self.session.request(
                method,
                yarl.URL(url, encoded=True),
                data=body,
                auth=auth,
                headers=req_headers,
                timeout=timeout,
                fingerprint=self.ssl_assert_fingerprint,
            ) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #7e0abe109702c9c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/opensearchpy/connection/pooling.py:62

        self._free_connections.put(con)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ba8e289452ae1b18 — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/helpers/test.py:37

OPENSEARCH_URL = os.environ.get("OPENSEARCH_URL", "https://localhost:9200")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c47b0dfa0045e7d3 — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/helpers/test.py:44

    if "PYTHON_CONNECTION_CLASS" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31270e7f0d328341 — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/helpers/test.py:48

            connection, os.environ["PYTHON_CONNECTION_CLASS"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9dd6316e2a2e5db0 — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/helpers/test.py:107

if "OPENSEARCH_VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #538e751a348f789e — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/helpers/test.py:108

    OPENSEARCH_VERSION = _get_version(os.environ["OPENSEARCH_VERSION"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b1e946d3e958da7 — Environment-variable access.

pkgs/python/[email protected]/opensearchpy/helpers/test.py:113

            http_auth=("admin", os.getenv("OPENSEARCH_PASSWORD", "admin")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7abd5c1f4d293d41 — Filesystem access.

pkgs/python/[email protected]/setup.py:37

with open(
    join(BASE_DIR, PACKAGE_NAME.replace("-", ""), "_version.py"), encoding="utf-8"
) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef4eaa825e0f981a — Filesystem access.

pkgs/python/[email protected]/setup.py:47

with open(join(BASE_DIR, "README.md"), encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

packaging

python dependency

expand_more 3 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #5c14a712175af316 — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:11

with open(os.path.join(_BASE_DIR, "src", "packaging", "__init__.py")) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c58e7f664cb48d18 — Filesystem access.

pkgs/python/[email protected]/src/packaging/_manylinux.py:34

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dad64fd99298f4c — Filesystem access.

pkgs/python/[email protected]/src/packaging/_musllinux.py:46

        with open(executable, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pandas

python dependency

expand_more 29 low-confidence finding(s)

low env_fs dependency Excluded from app score #7b70923b3fb65010 — Filesystem access.

pkgs/python/[email protected]/generate_pxi.py:8

    with open(pxifile, encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9d42f63f4ffa7eb — Filesystem access.

pkgs/python/[email protected]/generate_pxi.py:12

    with open(outfile, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e146abd06dfdb3b — Environment-variable access.

pkgs/python/[email protected]/generate_version.py:25

    if os.environ.get("MESON_DIST_ROOT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db3575ec018809b9 — Environment-variable access.

pkgs/python/[email protected]/generate_version.py:26

        path = os.path.join(os.environ.get("MESON_DIST_ROOT"), path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3e360d33fa86428 — Filesystem access.

pkgs/python/[email protected]/generate_version.py:27

    with open(path, "w", encoding="utf-8") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #670bcc12f8b983de — Environment-variable access.

pkgs/python/[email protected]/pandas/_testing/contexts.py:76

                    del os.environ["TZ"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #485b5b86a670cfc3 — Environment-variable access.

pkgs/python/[email protected]/pandas/_testing/contexts.py:80

                os.environ["TZ"] = tz

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b231a5a80883ae37 — Environment-variable access.

pkgs/python/[email protected]/pandas/_testing/contexts.py:85

    orig_tz = os.environ.get("TZ")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b495d5f4c9891c8 — Filesystem access.

pkgs/python/[email protected]/pandas/_version.py:159

        with open(versionfile_abs, encoding="utf-8") as fobj:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28ab4c5897aa989c — Environment-variable access.

pkgs/python/[email protected]/pandas/_version.py:264

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8b67b0741fa4ea7 — Environment-variable access.

pkgs/python/[email protected]/pandas/compat/__init__.py:154

    return os.environ.get("PANDAS_CI", "0") == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45827cfc7b2eeb57 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:425

        if os.environ.get("PANDAS_COPY_ON_WRITE", "0") == "warn"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8caf972d58ffcac — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:426

        else os.environ.get("PANDAS_COPY_ON_WRITE", "1") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36ef4f054a72024b — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:878

        False if os.environ.get("PANDAS_FUTURE_INFER_STRING", "1") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f391c0e1b945ef71 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:895

        os.environ.get("PANDAS_FUTURE_DISTINGUISH_NAN_AND_NA", "0") == "1",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2efacf510bcf1731 — Environment-variable access.

pkgs/python/[email protected]/pandas/core/config_init.py:906

        False if os.environ.get("PANDAS_FUTURE_PYTHON_SCALARS", "0") == "0" else True,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ab242faae8a388bf — Filesystem access.

pkgs/python/[email protected]/pandas/core/series.py:1573

            with open(buf, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5510236d47cf36b7 — Environment-variable access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:74

HAS_DISPLAY = os.getenv("DISPLAY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a97e36228fe4557 — Filesystem access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:302

        with open("/dev/clipboard", "w", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cfeeec934b9e9f0 — Filesystem access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:306

        with open("/dev/clipboard", encoding="utf-8") as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e17ac7ff785c5e85 — Environment-variable access.

pkgs/python/[email protected]/pandas/io/clipboard/__init__.py:569

        if os.environ.get("WAYLAND_DISPLAY") and _executable_exists("wl-copy"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #a037d3d9484e9669 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pandas/io/common.py:282

    return urllib.request.urlopen(*args, **kwargs)  # noqa: TID251

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #53c7f22ed0d059d4 — Filesystem access.

pkgs/python/[email protected]/pandas/io/common.py:930

            handle = open(
                handle,
                ioargs.mode,
                encoding=ioargs.encoding,
                errors=errors,
                newline="",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7df224e2a8ae9bc — Filesystem access.

pkgs/python/[email protected]/pandas/io/common.py:939

            handle = open(handle, ioargs.mode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #246272fd2edbffbf — Filesystem access.

pkgs/python/[email protected]/pandas/io/common.py:1192

        handle = open(handle, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15ed4664ca0f43dc — Filesystem access.

pkgs/python/[email protected]/pandas/io/formats/format.py:1076

        with open(buf, "w", encoding=encoding, newline="") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #daaccb3cf9c70054 — Environment-variable access.

pkgs/python/[email protected]/pandas/util/_print_versions.py:57

        "LC_ALL": os.environ.get("LC_ALL"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27f45c14f08289af — Environment-variable access.

pkgs/python/[email protected]/pandas/util/_print_versions.py:58

        "LANG": os.environ.get("LANG"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #361b66fdcbd99201 — Filesystem access.

pkgs/python/[email protected]/pandas/util/_print_versions.py:148

            with open(as_json, "w", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pipmaster

python dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #cacffecbb177c113 — Filesystem access.

pkgs/python/[email protected]/pipmaster/async_package_manager.py:273

            with open(requirements_file, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d0e7a84bd53f4a3e — Environment-variable access.

pkgs/python/[email protected]/pipmaster/core.py:112

            clean_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5383b8d24fa5c6b — Filesystem access.

pkgs/python/[email protected]/pipmaster/core.py:513

            with open(requirements_file, 'r', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #e6a4e8cbb454a1b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pipmaster/portable_python.py:132

                    with urllib.request.urlopen(req) as response:

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pre-commit

python dependency

expand_more 58 low-confidence finding(s)

low env_fs dependency Excluded from app score #28c8d708ecc2a9d6 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/color.py:98

            os.getenv('TERM') != 'dumb'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c01e77565a772bca — Environment-variable access.

pkgs/python/[email protected]/pre_commit/color.py:105

        '--color', default=os.environ.get('PRE_COMMIT_COLOR', 'auto'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ba63cc9fb72ebdb — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/autoupdate.py:125

    with open(path, newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1d4003a663dad34 — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/autoupdate.py:135

        with open(path, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc21304676d19d59 — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/autoupdate.py:158

    with open(path, 'w', newline='') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62a5977fa8806450 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/commands/hook_impl.py:22

    if os.environ.get('PRE_COMMIT_RUNNING_LEGACY'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1af07af1644bb80 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/commands/hook_impl.py:55

        if skip_on_missing_config or os.getenv('PRE_COMMIT_ALLOW_NO_CONFIG'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d729ca623c1d641b — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/install_uninstall.py:59

    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1eb5311507f5c4d — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/install_uninstall.py:92

    with open(hook_path, 'w') as hook_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9e2a70b1eb67cae — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/migrate_config.py:115

    with open(config_file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f67ec862260cf08 — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/migrate_config.py:129

        with open(config_file, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a56c8c7d60619da — Environment-variable access.

pkgs/python/[email protected]/pre_commit/commands/run.py:342

        environ: MutableMapping[str, str] = os.environ,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bc98240a4d2db51 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/commands/try_repo.py:37

        env = dict(os.environ, GIT_INDEX_FILE=idx, GIT_OBJECT_DIRECTORY=objs)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1f943037b7d3b03 — Filesystem access.

pkgs/python/[email protected]/pre_commit/commands/try_repo.py:68

        with open(config_filename, 'w') as cfg:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4134364bb85b2c5 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/envcontext.py:47

    env = os.environ if _env is None else _env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61cde0c757e6c115 — Filesystem access.

pkgs/python/[email protected]/pre_commit/error_handler.py:36

            log: IO[bytes] = ctx.enter_context(open(log_path, 'wb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5e4dcbdfea46c75 — Filesystem access.

pkgs/python/[email protected]/pre_commit/file_lock.py:73

    with open(path, 'a+') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11e959568eb7cd0f — Environment-variable access.

pkgs/python/[email protected]/pre_commit/git.py:36

    _env = _env if _env is not None else os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e2e1f545c4b79d7d — Filesystem access.

pkgs/python/[email protected]/pre_commit/git.py:118

    with open(os.path.join(get_git_dir('.'), 'MERGE_MSG'), 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b438fade516244b3 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/lang_base.py:136

    if 'PRE_COMMIT_NO_CONCURRENCY' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62928d147459f0f3 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/lang_base.py:140

        if 'TRAVIS' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #385282190a01ba4a — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/conda.py:51

    if os.environ.get('PRE_COMMIT_USE_MICROMAMBA'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1aaa917bfc891e25 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/conda.py:53

    elif os.environ.get('PRE_COMMIT_USE_MAMBA'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2996461c4ec3d358 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/dart.py:49

        dart_env = {**os.environ, 'PUB_CACHE': pub_cache}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #286a5d678a722b09 — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/dart.py:51

        with open(prefix_p.path('pubspec.yaml')) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7a41035520b409d3 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/dart.py:83

                env={**os.environ, 'PUB_CACHE': dep_tmp},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a9aa53d915d38eb — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/docker.py:36

        with open('/proc/1/mountinfo', 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #324131ea5dd8cbcc — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/dotnet.py:43

        with open(nuget_config, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #c9bc23e149bffe5a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/pre_commit/languages/golang.py:92

    resp = urllib.request.urlopen('https://go.dev/dl/?mode=json')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fb9cfa275c6d23a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pre_commit/languages/golang.py:104

        resp = urllib.request.urlopen(_get_url(version))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #fa5d6b58c1520848 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/golang.py:145

    env = no_git_env(dict(os.environ, GOPATH=gopath))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f70b24aaff0fb111 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/golang.py:151

            os.path.join(env_dir, '.go', 'bin'), os.environ['PATH'],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #510443a64b0f22db — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/julia.py:91

            open(os.path.join(envdir, 'Project.toml'), 'a').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8042edeb84db4849 — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/pygrep.py:24

    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb055af8c3491774 — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/pygrep.py:35

    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3527aa1339bfaf02 — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/pygrep.py:54

    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #783f0392aeaeb340 — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/pygrep.py:67

    with open(filename, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea9456bd1d6e477a — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/python.py:38

    with open(filename, encoding='UTF-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed713c35da55ffca — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/python.py:70

        env = dict(os.environ, PYTHONIOENCODING='UTF-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #234f0d379a1e597d — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/r.py:118

        with open(fname, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ece09bedc119f59d — Environment-variable access.

pkgs/python/[email protected]/pre_commit/languages/r.py:150

    r_home = os.environ.get('R_HOME')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #997748cfc5ad2747 — Filesystem access.

pkgs/python/[email protected]/pre_commit/languages/rust.py:97

                with open(rustup_init, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #882dc5c731da6a1d — Environment-variable access.

pkgs/python/[email protected]/pre_commit/main.py:39

os.environ.pop('__PYVENV_LAUNCHER__', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #259ec8ae707ab459 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/main.py:42

os.environ.pop('PYTHONEXECUTABLE', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2dcf7dd996059084 — Filesystem access.

pkgs/python/[email protected]/pre_commit/output.py:22

            stream = exit_stack.enter_context(open(logfile_name, 'ab'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bdf1217da0bc2bb — Environment-variable access.

pkgs/python/[email protected]/pre_commit/parse_shebang.py:29

    environ = env if env is not None else os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4354058d2ddffc9 — Filesystem access.

pkgs/python/[email protected]/pre_commit/repository.py:42

        with open(filename) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7058913550b0b16a — Filesystem access.

pkgs/python/[email protected]/pre_commit/repository.py:101

        with open(staging, 'w') as state_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95d7a62fc9fa7972 — Filesystem access.

pkgs/python/[email protected]/pre_commit/repository.py:106

        open(_state_filename_v2(venv), 'a+').close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7912240d61392c50 — Filesystem access.

pkgs/python/[email protected]/pre_commit/staged_files_only.py:74

        with open(patch_filename, 'wb') as patch_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94c5119f6761c714 — Environment-variable access.

pkgs/python/[email protected]/pre_commit/staged_files_only.py:78

        no_checkout_env = dict(os.environ, _PRE_COMMIT_SKIP_POST_CHECKOUT='1')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #180e1738638547ff — Environment-variable access.

pkgs/python/[email protected]/pre_commit/store.py:32

    ret = os.environ.get('PRE_COMMIT_HOME') or os.path.join(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a43a724c148cf7fd — Environment-variable access.

pkgs/python/[email protected]/pre_commit/store.py:33

        os.environ.get('XDG_CACHE_HOME') or os.path.expanduser('~/.cache'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e8dacde82dcc457 — Filesystem access.

pkgs/python/[email protected]/pre_commit/store.py:55

        with open(target_file, 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #484025c369a5f263 — Filesystem access.

pkgs/python/[email protected]/pre_commit/store.py:72

            with open(os.path.join(self.directory, 'README'), 'w') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a890f9be68bee0f — Filesystem access.

pkgs/python/[email protected]/pre_commit/util.py:40

    return files.joinpath(filename).read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e2893a9705ae0c5 — Filesystem access.

pkgs/python/[email protected]/pre_commit/util.py:176

        with open(os.devnull) as devnull, Pty() as pty:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #482787b6dc47930c — Environment-variable access.

pkgs/python/[email protected]/pre_commit/xargs.py:42

    environ = _env if _env is not None else getattr(os, 'environb', os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

psutil

python dependency

expand_more 28 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #6eb1d59caef03d76 — Filesystem access.

pkgs/python/[email protected]/docs/conf.py:39

    with open(INIT) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ceaf6bcf4b143fb8 — Environment-variable access.

pkgs/python/[email protected]/psutil/_common.py:34

PSUTIL_DEBUG = bool(os.getenv('PSUTIL_DEBUG'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #642e364cfb8545dd — Filesystem access.

pkgs/python/[email protected]/psutil/_common.py:682

    return open(fname, "rb", buffering=FILE_READ_BUFFER_SIZE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aab84044c83e0380 — Filesystem access.

pkgs/python/[email protected]/psutil/_common.py:692

    fobj = open(  # noqa: SIM115
        fname,
        buffering=FILE_READ_BUFFER_SIZE,
        encoding=ENCODING,
        errors=ENCODING_ERRS,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74f5abd59b93f79b — Environment-variable access.

pkgs/python/[email protected]/psutil/_psaix.py:375

        for path in os.environ["PATH"].split(":"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #313e1751468d211e — Filesystem access.

pkgs/python/[email protected]/psutil/_psbsd.py:142

        with open('/proc/meminfo', 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee64ab5164e323de — Filesystem access.

pkgs/python/[email protected]/psutil/_psbsd.py:276

        with open('/proc/stat', 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1bf50116b8edcf1a — Environment-variable access.

pkgs/python/[email protected]/psutil/_pssunos.py:119

            f"PATH=/usr/sbin:/sbin:{os.environ['PATH']}",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #897665d7bdd9765b — Filesystem access.

pkgs/python/[email protected]/scripts/internal/convert_readme.py:33

    with open(args.file) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ebf060bf55fa4d0c — Filesystem access.

pkgs/python/[email protected]/scripts/internal/download_wheels.py:64

    with open(OUTFILE, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #404982566f2cf134 — Filesystem access.

pkgs/python/[email protected]/scripts/internal/download_wheels.py:87

        with open(os.path.expanduser(args.tokenfile)) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #eb2e3a3a3852cb5f — Filesystem access.

pkgs/python/[email protected]/scripts/internal/find_broken_links.py:98

    with open(fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #40ef569255fa9537 — Filesystem access.

pkgs/python/[email protected]/scripts/internal/find_broken_links.py:113

    with open(fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d825ad1c3401e450 — Filesystem access.

pkgs/python/[email protected]/scripts/internal/find_broken_links.py:134

    with open(fname) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6b4f189eebdb2241 — Filesystem access.

pkgs/python/[email protected]/scripts/internal/find_broken_links.py:164

    with open(fname, errors='ignore') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d8a3377000b1889c — Filesystem access.

pkgs/python/[email protected]/scripts/internal/find_broken_links.py:178

        with open(fname, errors='ignore') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #5722119ba63438e1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/internal/find_broken_links.py:194

            res = requests.get(url, timeout=REQUEST_TIMEOUT)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #2a0ba4db3d588413 — Filesystem access.

pkgs/python/[email protected]/scripts/internal/git_pre_commit.py:156

    with open("MANIFEST.in", encoding="utf8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #f27b5ef7760201a4 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/internal/install_pip.py:34

        req = urlopen(URL, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #c2678b53b53b8b0e — Filesystem access.

pkgs/python/[email protected]/scripts/internal/print_announce.py:81

    with open(HISTORY) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3f3fc963617c1398 — Environment-variable access.

pkgs/python/[email protected]/scripts/internal/print_downloads.py:42

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #456f7a1de64caef7 — Filesystem access.

pkgs/python/[email protected]/scripts/internal/print_hashes.py:18

    with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #94ae11582cbe1a5c — Filesystem access.

pkgs/python/[email protected]/scripts/internal/purge_installation.py:56

                with open(path) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3e0098c89e967bf6 — Filesystem access.

pkgs/python/[email protected]/scripts/internal/purge_installation.py:64

                    with open(path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e752ef435da4033 — Environment-variable access.

pkgs/python/[email protected]/setup.py:46

        if "CIBUILDWHEEL" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02ec85fceeb81bde — Filesystem access.

pkgs/python/[email protected]/setup.py:142

    with open(INIT) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #826480a73abb2eff — Environment-variable access.

pkgs/python/[email protected]/setup.py:258

        if os.getenv('CC'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #092afb05acb9a756 — Environment-variable access.

pkgs/python/[email protected]/setup.py:259

            compiler.set_executable('compiler_so', os.getenv('CC'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pycryptodome

python dependency

expand_more 31 low-confidence finding(s)

low env_fs dependency Excluded from app score #53668f5d2e321a00 — Filesystem access.

pkgs/python/[email protected]/Doc/conf.py:81

for line in open(os.path.join("..", "lib", "Crypto", "__init__.py")):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c68617560d2f8cf6 — Environment-variable access.

pkgs/python/[email protected]/Doc/sphinx_rtd_theme/__init__.py:61

     context['READTHEDOCS'] = os.environ.get("READTHEDOCS", False) == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bfae14fe3ab7c6c5 — Environment-variable access.

pkgs/python/[email protected]/Doc/sphinx_rtd_theme/__init__.py:63

         for key, value in os.environ.items():

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5f3686e22231cd1 — Filesystem access.

pkgs/python/[email protected]/compiler_opt.py:48

    f = open(fname, 'w')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47793aef41f7ecf3 — Environment-variable access.

pkgs/python/[email protected]/compiler_opt.py:55

    debug = bool(os.environ.get('PYCRYPTODOME_DEBUG', None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c85952c15ef265c — Filesystem access.

pkgs/python/[email protected]/compiler_opt.py:62

        dev_null = open(os.devnull, "w")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8a01056713833b1 — Environment-variable access.

pkgs/python/[email protected]/lib/Crypto/Math/Numbers.py:36

    if os.getenv("PYCRYPTODOME_DISABLE_GMP"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee1dd4059d63f37a — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1022

        public_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efaaca07373fc233 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1032

        private_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bfd4b1f35c57478d — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1041

        public_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #94dbd572de220d76 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/ECC.py:1044

        private_public_key, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca83ff004bd4b512 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:767

    n, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #24268bdd1a741678 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:768

    e, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7cc0827e38f884ac — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:769

    d, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dd8ff0202826aac — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:770

    iqmp, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f18be7362646f30 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:771

    p, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bca9c5b61b1bbaad — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/PublicKey/RSA.py:772

    q, decrypted = read_bytes(decrypted)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93dea420f6c66f9f — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/Hash/test_BLAKE2.py:269

        with open(test_vector_file, "rt") as test_vector_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e9fc2ed03f6918f — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/Hash/test_BLAKE2.py:343

        with open(test_vector_file, "rt") as test_vector_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3edcb3d27c33bf4 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/Hash/test_BLAKE2.py:402

        with open(test_vector_file, "rt") as test_vector_fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad53ad5c8bc8a816 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/Protocol/test_HPKE.py:341

            with open(full_file_name, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #904b0add29955d21 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_Curve25519.py:64

        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69ea88d348c069aa — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_Curve448.py:37

        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f0132ab5e981c33 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_ECC.py:70

        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3fc48d57af09419 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/PublicKey/test_import_RSA.py:56

        with open(full_file_name, mode) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77f9c9c3ca1d1420 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/loader.py:167

        with open(full_file_name) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bffe4cee72370c7 — Filesystem access.

pkgs/python/[email protected]/lib/Crypto/SelfTest/loader.py:190

        with open(full_file_name) as file_in:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #631641682f569ccd — Environment-variable access.

pkgs/python/[email protected]/lib/Crypto/Util/_raw_api.py:102

        if hasattr(ffi, "RTLD_DEEPBIND") and not os.getenv('PYCRYPTODOME_DISABLE_DEEPBIND'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b94cae8d1a0da75f — Filesystem access.

pkgs/python/[email protected]/setup.py:236

            with open(full_file_name_dst, "rt", **extra_param) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0d3c976aaed5c454 — Filesystem access.

pkgs/python/[email protected]/setup.py:243

            with open(full_file_name_dst, "wt", **extra_param) as fd:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #844ee389805d05c9 — Filesystem access.

pkgs/python/[email protected]/setup.py:500

with open(os.path.join("lib", package_root, "__init__.py")) as init_root:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pydantic

python dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #fdd512fb6c64bba4 — Filesystem access.

pkgs/python/[email protected]/pydantic/deprecated/parse.py:71

    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c7ccc693ae00838 — Environment-variable access.

pkgs/python/[email protected]/pydantic/json_schema.py:344

                if os.getenv('PYDANTIC_PRIVATE_ALLOW_UNHANDLED_SCHEMA_TYPES'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #194cfd6e26cbe6d0 — Filesystem access.

pkgs/python/[email protected]/pydantic/mypy.py:1411

    with open(config_file, 'rb') as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cb0231a04cbedaea — Environment-variable access.

pkgs/python/[email protected]/pydantic/plugin/_loader.py:27

    disabled_plugins = os.getenv('PYDANTIC_DISABLE_PLUGINS')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f241ed2f1387e39d — Environment-variable access.

pkgs/python/[email protected]/pydantic/v1/env_settings.py:173

            env_vars: Mapping[str, Optional[str]] = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78abb51a9efb78d2 — Environment-variable access.

pkgs/python/[email protected]/pydantic/v1/env_settings.py:175

            env_vars = {k.lower(): v for k, v in os.environ.items()}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #189d911a65e316e6 — Filesystem access.

pkgs/python/[email protected]/pydantic/v1/env_settings.py:307

                    secret_value = path.read_text().strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59dcebe0ff4775b1 — Filesystem access.

pkgs/python/[email protected]/pydantic/v1/mypy.py:948

    with open(config_file, read_mode) as rf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28650afbb9bf35c4 — Filesystem access.

pkgs/python/[email protected]/pydantic/v1/parse.py:57

    b = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pymongo

python dependency

expand_more 117 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #ac9b3d359db8f7a0 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:292

    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3fb3373a772c6525 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:321

    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3547fb51f11c3a14 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/generate_config_utils.py:354

    data = target.read_text().splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #09decc278d918a77 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:64

    base_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #143064de1fc5d7e0 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:99

            os.environ["AZUREKMS_VMNAME_PREFIX"] = "PYTHON_DRIVER"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a5db54188730cf42 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102

            os.environ[

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #901e4e92e3bb31d6 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:102

            os.environ[
                "AZUREKMS_IMAGE"
            ] = "Canonical:0001-com-ubuntu-server-jammy:22_04-lts-gen2:latest"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b980d6be64c8ff2a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:106

            os.environ["GCPKMS_IMAGEFAMILY"] = "debian-12"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4004134c583c4b1e — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:128

        key_name = os.environ["KEY_NAME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a9eac426c5f537a2 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/kms_tester.py:129

        key_vault_endpoint = os.environ["KEY_VAULT_ENDPOINT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #1d755648c04ff564 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:17

            urllib.request.urlopen(url)  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #f2e3a431d504f44a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:26

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #82b27091d1386c84 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:64

        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bdbda10027bea184 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:72

    uri1 = os.environ["TEST_URI1"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #74136ecea811306f — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:73

    uri2 = os.environ["TEST_URI2"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f3ce6299477b0f09 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:81

        LOGGER.error(Path("error_log").read_text())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9d909e5aaccf3e56 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:86

    apache = os.environ["APACHE_BINARY"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #25d381e710deb66e — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/mod_wsgi_tester.py:87

    apache_config = os.environ["APACHE_CONFIG"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cb6b1fed071d772c — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:34

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #397b78eeeaa11d6a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:36

    if sub_test_name == "eks" and "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f6ae467189ff3647 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:39

            if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f8bea8243937c89a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:40

                write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #cf1eb5c85e3dc0ad — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:62

        return os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1be954dd22f2cddd — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/oidc_tester.py:84

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3f00b67abc1ae512 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:63

    spec_dir = pathlib.Path(os.environ["MDB_SPECS"]) / "source"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bd445b9fbe770f08 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/resync-all-specs.py:126

            with open(filename, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #05db87983916aa91 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:10

    os.environ[name] = str(value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0abc04644e72bb8a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:22

    if "VERSION" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ede0db22d917fa33 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:23

        os.environ["MONGODB_VERSION"] = os.environ["VERSION"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6dae626a692bc840 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:32

        os.environ["TOPOLOGY"] = "replica_set"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #abda06d4fd26b509 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:33

        os.environ["MONGODB_VERSION"] = "7.0"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #266a95fc3a3ffe9c — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_server.py:35

    if not os.environ.get("TEST_CRYPT_SHARED"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #785ce334ebf89c28 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:24

AUTH = os.environ.get("AUTH", "noauth")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #31a4f18b44569115 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:25

SSL = os.environ.get("SSL", "nossl")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d4b7610fe6d61dfb — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:26

UV_ARGS = os.environ.get("UV_ARGS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6d3359f66bef0bf5 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:27

TEST_PERF = os.environ.get("TEST_PERF")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #057b3f8d153a1200 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:28

GREEN_FRAMEWORK = os.environ.get("GREEN_FRAMEWORK")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #68a129efa20a1354 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:29

TEST_ARGS = os.environ.get("TEST_ARGS", "").split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a733a9c874627736 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:30

TEST_NAME = os.environ.get("TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f332f67b8a92423f — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:31

SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #aa6d7a0ec3fc171e — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:53

    with open("results.json") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #680380d3c3e9c6de — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:68

    with open("report.json", "w", newline="\n") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #0478e0de0c103f57 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:106

    env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fa98a3c3c6227aaf — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:150

    if not os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e5c26985db479d03 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:153

    if os.environ.get("PYMONGOCRYPT_LIB"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1c2fde9e7b1c7145 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:204

    if os.environ.get("DEBUG_LOG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9ec3382b8e867f79 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/run_tests.py:207

    if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2331ff73eb7bf02e — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:57

    value = os.environ.get(var, "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #5459e1277d4b7271 — Filesystem access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:65

    with open("/etc/os-release") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c500abc1a7915897 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:111

        url = os.environ["LIBMONGOCRYPT_URL"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #97e964f936de4526 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:116

    with request.urlopen(request.Request(url), timeout=15.0) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #1f392f1dfa440aca — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:181

            write_env(var, os.environ.get(var, getattr(opts, var.lower(), "")))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1c0b9ae97ee84b31 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:200

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b519adc9c3ccfe00 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:223

        if "AWS_ACCESS_KEY_ID" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a3b86e27c8698078 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:225

                if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e0ce65edad72e282 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:226

                    write_env(key, os.environ[key])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d48bc5c18dbb6d01 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:268

            os.environ["KRB5_CONFIG"] = str(krb_conf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #10512f62ba1a626c — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281

        SINGLE_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3b837153a4340f63 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:281

        SINGLE_MONGOS_LB_URI = os.environ.get(
            "SINGLE_MONGOS_LB_URI", "mongodb://127.0.0.1:8000/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2205eeabf3bf0454 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284

        MULTI_MONGOS_LB_URI = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4b7bf26cf2c12bfa — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:284

        MULTI_MONGOS_LB_URI = os.environ.get(
            "MULTI_MONGOS_LB_URI", "mongodb://127.0.0.1:8001/?loadBalanced=true"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #b13837e4d6f3ec98 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:304

            os.environ["OCSP_SERVER_TYPE"] = sub_test_name

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9c24fb23d3b79e78 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:306

            if name not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a9c8f5fb2c850040 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:309

        server_type = os.environ["OCSP_SERVER_TYPE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c0cafbf4ab122e6a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:310

        orch_file = os.environ["ORCHESTRATION_FILE"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #93adfd6297d9e85f — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:321

            env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f03046560ddbdec6 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:328

        version = os.environ.get("VERSION", "latest")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bd4c0aafc9977b96 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:349

    compressors = os.environ.get("COMPRESSORS") or opts.compressor

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4f5d7f4439d2c18f — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:412

        if "AWS_ROLE_SESSION_NAME" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bcec62159a6c8615 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/setup_tests.py:472

        framework = opts.green_framework or os.environ["GREEN_FRAMEWORK"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #91199819cae5dc2a — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:10

TEST_NAME = os.environ.get("TEST_NAME", "unconfigured")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #bf2b9aab5e173a8c — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:11

SUB_TEST_NAME = os.environ.get("SUB_TEST_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #16b49600fc9e9286 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:52

    Path(os.environ["OUTPUT_FILE"]).unlink(missing_ok=True)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d2447a05249595e1 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/teardown_tests.py:61

if os.environ.get("COVERAGE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a3bbc6fd05724523 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:15

DRIVERS_TOOLS = os.environ.get("DRIVERS_TOOLS", "").replace(os.sep, "/")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #7176b39d74d84539 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:169

        if env_var in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4eec7d782dc73fcb — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:173

                opts.auth = os.environ.get("AUTH") == "auth"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1d1577a98dde9e7c — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:175

                ssl_opt = os.environ.get("SSL", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e6771f9369529e81 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:178

                if os.environ[env_var]:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8847a468523207f3 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:181

                setattr(opts, key, os.environ[env_var])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #f0c94152d83150e3 — Environment-variable access.

pkgs/python/[email protected]/.evergreen/scripts/utils.py:211

    env = kwargs.pop("env", os.environ).copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #59587f8ec65c83b3 — Environment-variable access.

pkgs/python/[email protected]/_setup.py:71

            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de6a066c5502b85a — Environment-variable access.

pkgs/python/[email protected]/_setup.py:88

            if "ProgramFiles" in os.environ and "ProgramFiles(x86)" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bd57eeec33eb16a — Environment-variable access.

pkgs/python/[email protected]/_setup.py:89

                os.environ["ProgramFiles(x86)"] = os.environ["ProgramFiles"] + " (x86)"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #727629f242d435aa — Environment-variable access.

pkgs/python/[email protected]/_setup.py:94

            if os.environ.get("PYMONGO_C_EXT_MUST_BUILD"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f25a242c85fce4fa — Environment-variable access.

pkgs/python/[email protected]/_setup.py:127

if "--no_ext" in sys.argv or os.environ.get("NO_EXT"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #7491a4896a5c12a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pymongo/_azure_helpers.py:36

        with urlopen(request, timeout=timeout) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #fb1dbf87183dcd51 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pymongo/_gcp_helpers.py:29

        with urlopen(request, timeout=timeout) as response:  # noqa: S310

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #a20420287cea9004 — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:81

        token_file = os.environ.get("OIDC_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bd4b4486e9f1a5d — Filesystem access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:86

        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b04999105d876d0d — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:92

        token_file = os.environ.get("AWS_WEB_IDENTITY_TOKEN_FILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #941d4829ac980b67 — Filesystem access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:97

        with open(token_file) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #847cc17935190d44 — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:129

        if key in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28c9a472d4795427 — Environment-variable access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:130

            fname = os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0d00d0394de3fb9 — Filesystem access.

pkgs/python/[email protected]/pymongo/auth_oidc_shared.py:131

    with open(fname) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #701377235a22d3b3 — Filesystem access.

pkgs/python/[email protected]/pymongo/common.py:238

    open(value).close()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03ce4d51a7dfab41 — Filesystem access.

pkgs/python/[email protected]/pymongo/daemon.py:64

            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82b2f5e295cca217 — Filesystem access.

pkgs/python/[email protected]/pymongo/daemon.py:95

            with open(os.devnull, "r+b") as devnull:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55fc72992cb032e5 — Environment-variable access.

pkgs/python/[email protected]/pymongo/logger.py:165

        document_length = int(os.getenv("MONGOB_LOG_MAX_DOCUMENT_LENGTH", _DEFAULT_DOCUMENT_LENGTH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #2314afdd1c75dfcd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/pymongo/ocsp_support.py:295

            response = _post(
                uri,
                data=ocsp_request.public_bytes(_Encoding.DER),
                headers={"Content-Type": "application/ocsp-request"},
                timeout=timeout,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #591c40bc0559d001 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:78

        "architecture": os.environ.get("PROCESSOR_ARCHITECTURE") or platform.machine(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b49e3ddf2040214e — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:119

    if os.getenv(ENV_VAR_K8S):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #735910b9b545c440 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:126

    if os.getenv("AWS_LAMBDA_RUNTIME_API"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a3b1b9e7dfe9c53 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:128

    env = os.getenv("AWS_EXECUTION_ENV")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79fdc81ae786289c — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:135

    return bool(os.getenv("FUNCTIONS_WORKER_RUNTIME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51b7643ef22fb219 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:139

    return bool(os.getenv("K_SERVICE") or os.getenv("FUNCTION_NAME"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1718d834964d7ea — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:143

    return bool(os.getenv("VERCEL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #740f80ae05f467c5 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:152

    val = os.getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #944ff68dd339e844 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:171

        region = os.getenv("AWS_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #be511cc02989fa2e — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:181

        region = os.getenv("FUNCTION_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #644c8828103de871 — Environment-variable access.

pkgs/python/[email protected]/pymongo/pool_options.py:192

        region = os.getenv("VERCEL_REGION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #145ca3a8aaabd14f — Filesystem access.

pkgs/python/[email protected]/tools/compare_import_time.py:23

    with open(f"pymongo-{sha}.log") as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d1893f2580f69269 — Filesystem access.

pkgs/python/[email protected]/tools/convert_test_to_async.py:123

    with open(input_file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #014d6e153ad23c48 — Filesystem access.

pkgs/python/[email protected]/tools/convert_test_to_async.py:127

        with open(output_file, "w+") as f2:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #45c31437e166deae — Filesystem access.

pkgs/python/[email protected]/tools/ensure_future_annotations_import.py:29

        with open(path) as fid:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e6c7fe6a856d89fa — Filesystem access.

pkgs/python/[email protected]/tools/synchro.py:290

            with open(file, "r+") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1f84ca3fecd73e1c — Environment-variable access.

pkgs/python/[email protected]/tools/synchro.py:442

            and "OVERRIDE_SYNCHRO_CHECK" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pypdf

python dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #19a8fd7b6c6dc802 — Filesystem access.

pkgs/python/[email protected]/pypdf/_page.py:2033

            debug_path.joinpath("fonts.json").write_text(
                json.dumps(fonts, indent=2, default=asdict),
                "utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3fe8f9f32f92101 — Filesystem access.

pkgs/python/[email protected]/pypdf/_reader.py:172

            with open(stream, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ad0d7b2ac96ab76 — Filesystem access.

pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:285

        debug_path.joinpath("bt_groups.json").write_text(
            json.dumps(ty_groups, indent=2, default=str), "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16ceab25e8fc2c87 — Filesystem access.

pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:351

        debug_path.joinpath("bts.json").write_text(
            json.dumps(bt_groups, indent=2, default=str), "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ffbf2c4067b17c6 — Filesystem access.

pkgs/python/[email protected]/pypdf/_text_extraction/_layout_mode/_fixed_width_page.py:354

        debug_path.joinpath("tjs.json").write_text(
            json.dumps(
                tj_ops, indent=2, default=lambda x: getattr(x, "to_dict", str)(x)
            ),
            "utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e37e254731e4fb1 — Filesystem access.

pkgs/python/[email protected]/pypdf/_utils.py:391

    with open("pypdf_pdfLocation.txt", "wb") as output_fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf11a93f8fa93e94 — Filesystem access.

pkgs/python/[email protected]/pypdf/_writer.py:245

                with open(fileobj, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9926119097f688d3 — Environment-variable access.

pkgs/python/[email protected]/pypdf/filters.py:752

            environment = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #ddb7c3f7959fd242 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/resources/afm_to_dataclass.py:24

        with urllib.request.urlopen(
            f"https://{FONT_LOC}"
        ) as connection, ZipFile(BytesIO(

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pypinyin

python dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #f81a75d35ba237b4 — Environment-variable access.

pkgs/python/[email protected]/pypinyin/constants.py:15

if os.environ.get('PYPINYIN_NO_PHRASES'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #084a87baf30e94fd — Environment-variable access.

pkgs/python/[email protected]/pypinyin/constants.py:25

if not os.environ.get('PYPINYIN_NO_DICT_COPY'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d890cb0a896bd6e — Filesystem access.

pkgs/python/[email protected]/pypinyin/phrases_dict.py:16

    with open(_json_path, encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83715902c1aa4f9d — Filesystem access.

pkgs/python/[email protected]/pypinyin/pinyin_dict.py:15

    with open(_json_path, encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fab83a3dc07e5bbc — Filesystem access.

pkgs/python/[email protected]/setup.py:41

    with open(os.path.join(current_dir, 'pypinyin/__init__.py'),
              encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0722e126af3cf77f — Filesystem access.

pkgs/python/[email protected]/setup.py:49

    with open(os.path.join(current_dir, 'README.rst'),
              encoding='utf8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytest

python dependency

expand_more 437 low-confidence finding(s)

low env_fs dependency Excluded from app score #f70c031f28a12b97 — Environment-variable access.

pkgs/python/[email protected]/doc/en/conf.py:272

    os.getenv("READTHEDOCS", "False") == "True"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4dd66681e37205a — Environment-variable access.

pkgs/python/[email protected]/doc/en/conf.py:273

    and os.environ["READTHEDOCS_VERSION_TYPE"] == "tag"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3dad3b91e534c7c1 — Filesystem access.

pkgs/python/[email protected]/doc/en/example/customdirectory/conftest.py:16

        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a76005be55123498 — Filesystem access.

pkgs/python/[email protected]/doc/en/example/multipython.py:36

        dumpfile.write_text(
            textwrap.dedent(
                rf"""
                import pickle
                f = open({str(self.picklefile)!r}, 'wb')
                s = pickle.dump({obj!r}, f, protocol=2)
                f.close()
                """
            )
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #1e765b595bd9492f — Filesystem access.

pkgs/python/[email protected]/doc/en/example/multipython.py:50

        loadfile.write_text(
            textwrap.dedent(
                rf"""
                import pickle
                f = open({str(self.picklefile)!r}, 'rb')
                obj = pickle.load(f)
                f.close()
                res = eval({expression!r})
                if not res:
                    raise SystemExit(1)
                """
            )
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #9e903ceb9343b708 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/extra/get_issues.py:18

        r = requests.get(url, params=get_data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ea86dbd06cba4104 — Filesystem access.

pkgs/python/[email protected]/extra/get_issues.py:41

        cachefile.write_text(json.dumps(issues), "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df0a10aaa9e3abd2 — Filesystem access.

pkgs/python/[email protected]/extra/get_issues.py:43

        issues = json.loads(cachefile.read_text("utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #22e118b91d992bb3 — Filesystem access.

pkgs/python/[email protected]/scripts/generate-gh-release-notes.py:24

    changelog_lines = p.read_text(encoding="UTF-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #6bd3e3c3e8ae3f8c — Filesystem access.

pkgs/python/[email protected]/scripts/generate-gh-release-notes.py:61

    Path(filename).write_text(md_body, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #ae0a7708fa1eec33 — Filesystem access.

pkgs/python/[email protected]/scripts/release.py:44

    template_text = (
        Path(__file__).parent.joinpath(template_name).read_text(encoding="UTF-8")
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d7edc291c74946d5 — Filesystem access.

pkgs/python/[email protected]/scripts/release.py:54

    target.write_text(text, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #25ecf83582b2e8ec — Filesystem access.

pkgs/python/[email protected]/scripts/release.py:59

    lines = index_path.read_text(encoding="UTF-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #3d787283c8c52020 — Filesystem access.

pkgs/python/[email protected]/scripts/release.py:66

                index_path.write_text("\n".join(lines) + "\n", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e64644c539e49088 — Environment-variable access.

pkgs/python/[email protected]/scripts/release.py:84

        env={**os.environ, "SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST": version},

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #cb2e243620d779ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/update-plugin-list.py:94

    response = session.get(f"https://pypi.org/pypi/{name}/json")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #da6c777093be5098 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/update-plugin-list.py:96

        response = session.get(f"https://pypi.org/pypi/{name}/json", refresh=True)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #1ea29a3021283aa3 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/update-plugin-list.py:109

    response = session.get(
        "https://pypi.org/simple",
        headers={"Accept": "application/vnd.pypi.simple.v1+json"},
        refresh=True,
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #28b6b36b162a57bf — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_argcomplete.py:102

if os.environ.get("_ARGCOMPLETE"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00728e4ce2afa272 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:37

    if os.environ.get("PY_COLORS") == "1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e8b8058ee1da723 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:39

    if os.environ.get("PY_COLORS") == "0":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #257983b215bc10b8 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:41

    if os.environ.get("NO_COLOR"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1603261c38d7528e — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:43

    if os.environ.get("FORCE_COLOR"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99394a03d741b686 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:46

        hasattr(file, "isatty") and file.isatty() and os.environ.get("TERM") != "dumb"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d41f79811288386 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:219

        theme = os.getenv("PYTEST_THEME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eba8b6cc62151767 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_io/terminalwriter.py:220

        theme_mode = os.getenv("PYTEST_THEME_MODE", "dark")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #364f1e46610ecd8f — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1137

                ignore = os.getenv("PY_IGNORE_IMPORTMISMATCH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c86cd01c77e7675d — Filesystem access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1152

                    with open(str(self), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50d1ba154339d73a — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1208

                    paths = os.environ["Path"].split(";")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5fda3c173530501 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1212

                        systemroot = os.environ["SYSTEMROOT"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1442b4ca150e729e — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1220

                    paths = os.environ["PATH"].split(":")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f61f3d46ddaaafc3 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1223

                tryadd += os.environ["PATHEXT"].split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b01f1e1b71d33494 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1242

            x = os.environ["HOME"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ee9729637f551d6 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1245

                x = os.environ["HOMEDRIVE"] + os.environ["HOMEPATH"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d3bfdaf35cd84d50 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1416

            username = os.environ["USER"]  # linux, et al

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #263850ccf0c9a17c — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/_py/path.py:1419

                username = os.environ["USERNAME"]  # windows

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #056d35b74df5d3c1 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:293

        with open(pathname, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #384f530f4e5bbe8a — Filesystem access.

pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:326

        with open(proc_pyc, "wb") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31f308bf339b8158 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:346

    source = fn.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e06ab0a453bf357 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/assertion/rewrite.py:362

        fp = open(pyc, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23a24c347c73344e — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/cacheprovider.py:519

    if "TOX_ENV_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2c25a1ae1073376 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/cacheprovider.py:520

        cache_dir_default = os.path.join(os.environ["TOX_ENV_DIR"], cache_dir_default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c44e41e300e57ca1 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/capture.py:143

            open(os.dup(f.fileno()), mode, buffering),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17deea7ee039d4ee — Filesystem access.

pkgs/python/[email protected]/src/_pytest/capture.py:489

            self.tmpfile = open(os.devnull, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4f0bd958794a412 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/compat.py:315

    return any(os.environ.get(var) for var in env_vars)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bac393be396f1ecb — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:219

    old_pytest_version = os.environ.get("PYTEST_VERSION")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c4e7f063c1f3655 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:221

        os.environ["PYTEST_VERSION"] = __version__

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9c6dc475ca12114 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:241

            os.environ.pop("PYTEST_VERSION", None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb798bf24b479d0a — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:243

            os.environ["PYTEST_VERSION"] = old_pytest_version

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dba5a120163455a4 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:501

        if os.environ.get("PYTEST_DEBUG"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88342771ed20e549 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:505

                err = open(
                    os.dup(err.fileno()),
                    mode=err.mode,
                    buffering=1,
                    encoding=encoding,
                )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0346cc6561419ae1 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:874

        self._import_plugin_specs(os.environ.get("PYTEST_PLUGINS"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c692e5b540f210a — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:1336

        ) or bool(os.environ.get("PYTEST_DISABLE_PLUGIN_AUTOLOAD"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdb27334e8fc6a14 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:1523

            env_addopts = os.environ.get("PYTEST_ADDOPTS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #895d8f053298a38f — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/config/__init__.py:1578

            not os.environ.get("PYTEST_DISABLE_PLUGIN_AUTOLOAD")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8c246467227e99f1 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/config/findpaths.py:102

        toml_text = filepath.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f70efbcd0203381 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/doctest.py:144

    contents = path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #38164a6d44808f65 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/doctest.py:429

        text = self.path.read_text(encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3143d5d385d8305 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/helpconfig.py:129

        debugfile = open(path, "w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #863fc82e1b23ccb5 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/junitxml.py:652

        with open(self.logfile, "w", encoding="utf-8") as logfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a3de33f37893703d — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/monkeypatch.py:324

        if prepend and name in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #deeb453c549ce171 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/monkeypatch.py:325

            value = value + prepend + os.environ[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a7a3ed1bd886b51 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/monkeypatch.py:326

        self.setitem(os.environ, name, value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cbd7cd4eb4963764 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/monkeypatch.py:334

        environ: MutableMapping[str, str] = os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #837f6dedac93d475 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/src/_pytest/pastebin.py:91

            urlopen(url, data=urlencode(params).encode("ascii")).read().decode("utf-8")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #2fbc1f97bc0ab670 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/pathlib.py:602

    ignore = os.environ.get("PY_IGNORE_IMPORTMISMATCH", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ae47479cc9780a1 — Filesystem access.

pkgs/python/[email protected]/src/_pytest/pytester.py:790

            p.write_text(source.strip(), encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28e0bc1d5b6a5689 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/pytester.py:1364

        env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a461e3357dc6a32 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/runner.py:215

        os.environ[var_name] = value

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6024664287e99e32 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/runner.py:217

        os.environ.pop(var_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #07b336990db9c2c5 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/terminalprogress.py:28

    if reporter is not None and reporter.isatty() and os.environ.get("TERM") != "dumb":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #78aeaccd128ad9e3 — Environment-variable access.

pkgs/python/[email protected]/src/_pytest/tmpdir.py:161

            from_env = os.environ.get("PYTEST_DEBUG_TEMPROOT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb0fc51ddc8fb444 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:378

            s1 = initpy.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2592b85e377705b9 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:379

            s2 = copied.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #210d3ca779b5e428 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:392

            s1 = otherdir.join("__init__.py").read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #324379baa43bbcd0 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:393

            s2 = copied.join("__init__.py").read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3291af074f992811 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:464

        stream = open(f, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9bfa9d245e27320 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:478

    samplefile.write_text("samplefile\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #414e3debca3685ec — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:481

    execfile.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #73eb68ff9d3ad71b — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:484

    execfilepy.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10ec4ea6c6afa03e — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:496

    module_a.write_text("from .b import stuff as result\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99dfdd636b337548 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:498

    module_b.write_text('stuff="got it"\n', encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c42b39aff5dd9b4 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:500

    module_c.write_text(
        """import py;
import otherdir.a
value = otherdir.a.result
""",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d46c2f2ffb2dbc35 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:508

    module_d.write_text(
        """import py;
from otherdir import a
value2 = a.result
""",
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe79b4a910ab861c — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:551

        file_.write_text(f"{i}", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d04bc70c8fad4076 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:552

        actual = int(file_.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ffc32647a84b004 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:714

        assert p.read_text(encoding="utf-8") == "hello"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05e62d7801859b81 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:718

        p.write_text("hello", ensure=1, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #776e4d7fd17c160f — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:719

        assert p.read_text(encoding="utf-8") == "hello"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bde75920a4193df0 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:786

        newfile.write_text("42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de74b7ebdfa6da1c — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:788

        s = newfile.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #113a040d437a2d86 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:822

        l1.write_text("foo", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #32d791bf4da047ff — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:824

        assert l2.read_text(encoding="utf-8") == "foo"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aeb44fa32af1bb72 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1300

        filepath.write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff3a82a979db5362 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1307

        filepath.write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #744ce8de3d327380 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1315

        filepath.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39c3cd5cfff1de1c — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1324

        filepath.write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18bfe77d9914b440 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1327

        assert filepath.read_text(encoding="utf-8") == linkpath.read_text(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64add51ba96deff6 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1327

        assert filepath.read_text(encoding="utf-8") == linkpath.read_text(
            encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f2def9bded9be31 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1362

        filepath.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f9ad0eccb244d4bc — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1493

            src.join(f).write_text(f, ensure=True, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8913234a59fef76f — Environment-variable access.

pkgs/python/[email protected]/testing/_py/test_local.py:1528

        if "LANG" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a453f21d66a2a7ea — Environment-variable access.

pkgs/python/[email protected]/testing/_py/test_local.py:1536

        if "LANG" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c2c9dd42922b5d5 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1561

        s = x.read_text(encoding="utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41c7ccb2df6418b5 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1569

        x.write_text(part, encoding="utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cc702a585dfeef0 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1571

        assert x.read_text(encoding="utf8") == part

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1c8f46cb3bfe4c8 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1577

        x.write_text(part, "ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17353d227d5e5ca3 — Filesystem access.

pkgs/python/[email protected]/testing/_py/test_local.py:1578

        s = x.read_text("ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #074f7dfd411cd97a — Environment-variable access.

pkgs/python/[email protected]/testing/acceptance_test.py:22

    cur = os.getenv("PYTHONPATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #28134b6a46dd4969 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:279

        sub1.joinpath("conftest.py").write_text("assert 0", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c9e690de11bfc958 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:518

        p.write_text("def test_foo(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e09e8393f8bdf593 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:663

        path.joinpath("test_hello.py").write_text("raise ImportError", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #4ca3d4a3a093dc72 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:672

        pkg.joinpath("test_foo.py").write_text(
            "print('hello from test_foo')\ndef test(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #702dde1857c8a81d — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:675

        pkg.joinpath("conftest.py").write_text(
            "def pytest_configure(config): print('configuring')", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #a485f6c014b1da35 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:689

        pytester.path.joinpath("t.py").write_text("def test(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #adcdc05116762c2c — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:698

        path.joinpath("test_hello.py").write_text(
            "def test_hello(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e8dbb179ae4d76bf — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:701

        path.joinpath("test_world.py").write_text(
            "def test_world(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #79b5ba2de6abb639 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:745

            ns.joinpath("__init__.py").write_text(
                "__import__('pkg_resources').declare_namespace(__name__)",
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #c1ba06e52ab226d3 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:752

            lib.joinpath(f"test_{dirname}.py").write_text(
                f"def test_{dirname}(): pass\ndef test_other():pass",
                encoding="utf-8",
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e8ac0e8db90f2113 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:839

        lib.joinpath("test_bar.py").write_text(
            "def test_bar(): pass\ndef test_other(a_fixture):pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #96bf828ac6b2e44b — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:842

        lib.joinpath("conftest.py").write_text(
            "import pytest\[email protected]\ndef a_fixture():pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #d80923a6991417d4 — Filesystem access.

pkgs/python/[email protected]/testing/acceptance_test.py:1447

    fullXml = pytester.path.joinpath("output.xml").read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67818a1a08f65008 — Filesystem access.

pkgs/python/[email protected]/testing/code/test_excinfo.py:399

    tmp_path.joinpath("test.txt").write_text("{{ h()}}:", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5176771ff6b9de6 — Filesystem access.

pkgs/python/[email protected]/testing/code/test_excinfo.py:596

            modpath.write_text(source, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10159a497e157895 — Filesystem access.

pkgs/python/[email protected]/testing/code/test_excinfo.py:1252

        tmp_path.joinpath("mod.py").write_text("asdf", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5276b2a49ad72c3 — Filesystem access.

pkgs/python/[email protected]/testing/code/test_source.py:298

    path.write_text(str(source), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14a85b8ab3483f53 — Filesystem access.

pkgs/python/[email protected]/testing/example_scripts/customdirectory/conftest.py:13

        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d402b2991e47f040 — Filesystem access.

pkgs/python/[email protected]/testing/example_scripts/perf_examples/collect_stats/generate_folders.py:9

TEST_CONTENT = (HERE / "template_test.py").read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f0eb09d6f73e0194 — Filesystem access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:75

            f = open(str(p), "w+", encoding="utf8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0fa72fe2c7b5c997 — Filesystem access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:80

                with open(str(p), encoding="utf8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b63879a4769f8749 — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:188

    monkeypatch.setitem(os.environ, "PY_COLORS", "1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d2c8e4ff26caa1a — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:193

    monkeypatch.setitem(os.environ, "PY_COLORS", "0")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b32af509cb3a65f3 — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:198

    monkeypatch.setitem(os.environ, "NO_COLOR", "1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ddaced658fc179f8 — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:203

    monkeypatch.setitem(os.environ, "FORCE_COLOR", "1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72452fb4abdcdfa6 — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:221

    monkeypatch.setitem(os.environ, "NO_COLOR", NO_COLOR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dce78cf0fe721db6 — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:222

    monkeypatch.setitem(os.environ, "FORCE_COLOR", FORCE_COLOR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6611b0c8176f3c8 — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:228

    monkeypatch.setitem(os.environ, "NO_COLOR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e8a64b20b2b28b0 — Environment-variable access.

pkgs/python/[email protected]/testing/io/test_terminalwriter.py:229

    monkeypatch.setitem(os.environ, "FORCE_COLOR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b47c00ca566d384 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:87

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4a3e8402b67adce — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:661

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #748d478fb5e6c14b — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:684

    with open(log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a8eff249b367b58 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:700

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #904bcd8c6df633d7 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:759

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc503b5084347087 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:808

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d4081f0322a663ff — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:838

    with open(log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6247568622374a1 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:848

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc24a684e619a890 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:886

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6b4a99a4be5994d1 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:918

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42c920e964bfd73f — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1055

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6068f473e9a0f9d7 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1089

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0f8e91109c17a32 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1123

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #699c5e928deaa513 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1165

    with open(os.path.join(report_dir_base, "test_first"), encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #521594a555499755 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1169

    with open(os.path.join(report_dir_base, "test_second"), encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c58ac0958ffee6d5 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1214

    with open(test_first_log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8b594b5a524ce651 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1217

    with open(test_second_log_file, mode="w", encoding="utf-8") as wfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2fcbf670e74a83e6 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1223

    with open(test_first_log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1d19843ccda7f0e — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1228

    with open(test_second_log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #517a3f04286d0407 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1553

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13d95940e2178065 — Filesystem access.

pkgs/python/[email protected]/testing/logging/test_reporting.py:1574

    with open(log_file, encoding="utf-8") as rfh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7545e6601ba24bfb — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:57

        p.write_text(
            textwrap.dedent(
                f"""\
                import x456
                def test():
                    assert x456.__file__.startswith({str(root2)!r})
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69c947aa141dac27 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:929

        b.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.hookimpl(wrapper=True)
                def pytest_pycollect_makemodule():
                    mod = yield
                    mod.obj.hello = "world"
                    return mod
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc6c80cf45122387 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:942

        b.joinpath("test_module.py").write_text(
            textwrap.dedent(
                """\
                def test_hello():
                    assert hello == "world"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9961b491d88ec304 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:957

        b.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.hookimpl(wrapper=True)
                def pytest_pycollect_makeitem():
                    result = yield
                    if result:
                        for func in result:
                            func._some123 = "world"
                    return result
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88d7ef5ff5af09c1 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:972

        b.joinpath("test_module.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture()
                def obj(request):
                    return request.node._some123
                def test_hello(obj):
                    assert obj == "world"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #841cc42021c4af99 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1073

    sub1.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            def pytest_runtest_setup(item):
                assert item.path.stem == "test_in_sub1"
            def pytest_runtest_call(item):
                assert item.path.stem == "test_in_sub1"
            def pytest_runtest_teardown(item):
                assert item.path.stem == "test_in_sub1"
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #41bbeac2174f16ed — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1087

    sub2.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            def pytest_runtest_setup(item):
                assert item.path.stem == "test_in_sub2"
            def pytest_runtest_call(item):
                assert item.path.stem == "test_in_sub2"
            def pytest_runtest_teardown(item):
                assert item.path.stem == "test_in_sub2"
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f341d853351a5095 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1101

    sub1.joinpath("test_in_sub1.py").write_text("def test_1(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #568d038d3e5886d8 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1102

    sub2.joinpath("test_in_sub2.py").write_text("def test_2(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b5b6e8a038c75634 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1484

    fh.write_text(
        textwrap.dedent(
            """\
            import pytest
            def test_real():
                pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4eb8cb257e8b546 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1505

    fh.write_text(
        textwrap.dedent(
            """\
            import pytest
            def test_real():
                pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45c521c9f4a65e00 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1563

    sub1_test.joinpath("test_in_sub1.py").write_text(
        "def test_1(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5e09c8fe450d13b — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1566

    sub2_test.joinpath("test_in_sub2.py").write_text(
        "def test_2(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1b2cf88a7b9d5016 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1612

    root.joinpath("Test_root.py").write_text("def test_1(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #64596fd49e91fa30 — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1613

    sub1.joinpath("Test_sub1.py").write_text("def test_2(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8bbac84d8cdaf85f — Filesystem access.

pkgs/python/[email protected]/testing/python/collect.py:1614

    sub2_test.joinpath("test_sub2.py").write_text(
        "def test_3(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0882d516e39472da — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:311

        subdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture
                def spam():
                    return 'spam'
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6760e6e6415e3e7f — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:324

        testfile.write_text(
            textwrap.dedent(
                """\
                def test_spam(spam):
                    assert spam == "spam"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #075940bdf5ee0aff — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:385

        subdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture(params=[1, 2, 3])
                def spam(request):
                    return request.param
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #02622127ad8c35f3 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:398

        testfile.write_text(
            textwrap.dedent(
                """\
                params = {'spam': 1}

                def test_spam(spam):
                    assert spam == params['spam']
                    params['spam'] += 1
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ed5526291dd2c41 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:431

        subdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture(params=[1, 2, 3])
                def spam(request):
                    return request.param
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d02e16e8a9e9b32 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:444

        testfile.write_text(
            textwrap.dedent(
                """\
                params = {'spam': 1}

                def test_spam(spam):
                    assert spam == params['spam']
                    params['spam'] += 1
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a5a473161103a5f — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:1233

        b.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def arg1():
                    pass
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0322a282f9c86473 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:1245

        p.write_text("def test_func(arg1): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3f327feac7233e38 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:1958

        package.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest
            @pytest.fixture
            def one():
                return 1
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #147ee8468607187a — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:1969

        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                def test_x(one):
                    assert one == 1
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f92c5adcab60350 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:1981

        sub.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def one():
                    return 2
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f4d5841a20b9d0e — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:1992

        sub.joinpath("test_y.py").write_text(
            textwrap.dedent(
                """\
                def test_x(one):
                    assert one == 2
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f7ba6bc78641770 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2015

        package.joinpath("__init__.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def setup_module():
                    values.append("package")
                def teardown_module():
                    values[:] = []
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69b0d3f4442acecc — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2027

        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def test_x():
                    assert values == ["package"]
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14f7a60f73fe9c4f — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2038

        package.joinpath("__init__.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def setup_module():
                    values.append("package2")
                def teardown_module():
                    values[:] = []
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f86487dcae6bb901 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2050

        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def test_x():
                    assert values == ["package2"]
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99b6a541ce840efd — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2071

        package.joinpath("__init__.py").write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3429601e1ce3c02 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2072

        package.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                from .. import values
                @pytest.fixture(scope="package")
                def one():
                    values.append("package")
                    yield values
                    values.pop()
                @pytest.fixture(scope="package", autouse=True)
                def two():
                    values.append("package-auto")
                    yield values
                    values.pop()
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ebfcc2a7a36fcf0 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2091

        package.joinpath("test_x.py").write_text(
            textwrap.dedent(
                """\
                from .. import values
                def test_package_autouse():
                    assert values == ["package-auto"]
                def test_package(one):
                    assert values == ["package-auto", "package"]
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25eb697195d91206 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2251

        a.joinpath("test_something.py").write_text(
            "def test_func(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c425f8df2108a55c — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2254

        b.joinpath("test_otherthing.py").write_text(
            "def test_func(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8a3c3e3d5927ed23 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2293

        pkgdir.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture(autouse=True)
                def app():
                    import sys
                    sys._myapp = "hello"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f75b30ef9d0ab02a — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:2309

        t.write_text(
            textwrap.dedent(
                """\
                import sys
                def test_app():
                    assert sys._myapp == "hello"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5b6bf63aeb61740 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:3340

        b.joinpath("test_overridden_fixture_finalizer.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def browser(browser):
                    browser['visited'] = True
                    return browser

                def test_browser(browser):
                    assert browser['visited'] is True
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9eac114115e84b1 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:4318

        fixfile.write_text(
            textwrap.dedent(
                """\
                import pytest

                @pytest.fixture(params=[0, 1, 2])
                def fix_with_param(request):
                    return request.param
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e28c27d97c431923 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:4332

        testfile.write_text(
            textwrap.dedent(
                """\
                from fix import fix_with_param

                def test_foo(request):
                    request.getfixturevalue('fix_with_param')
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc0a62b379df028e — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:4837

        root.joinpath("__init__.py").write_text("values = []", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f3ae1bf41932b98 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:4841

        sub1.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest
            from .. import values
            @pytest.fixture(scope="package")
            def fix():
                values.append("pre-sub1")
                yield values
                assert values.pop() == "pre-sub1"
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e02e5d823a2ef67d — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:4855

        sub1.joinpath("test_1.py").write_text(
            textwrap.dedent(
                """\
            from .. import values
            def test_1(fix):
                assert values == ["pre-sub1"]
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #275ae86a02ff1444 — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:4868

        sub2.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest
            from .. import values
            @pytest.fixture(scope="package")
            def fix():
                values.append("pre-sub2")
                yield values
                assert values.pop() == "pre-sub2"
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa887cd9a735c49e — Filesystem access.

pkgs/python/[email protected]/testing/python/fixtures.py:4882

        sub2.joinpath("test_2.py").write_text(
            textwrap.dedent(
                """\
            from .. import values
            def test_2(fix):
                assert values == ["pre-sub2"]
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e61453997d6e9f2 — Filesystem access.

pkgs/python/[email protected]/testing/python/metafunc.py:1585

        sub1.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                def pytest_generate_tests(metafunc):
                    assert metafunc.function.__name__ == "test_1"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87593f27300cd948 — Filesystem access.

pkgs/python/[email protected]/testing/python/metafunc.py:1594

        sub2.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                def pytest_generate_tests(metafunc):
                    assert metafunc.function.__name__ == "test_2"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #592ba1269f1f6d92 — Filesystem access.

pkgs/python/[email protected]/testing/python/metafunc.py:1603

        sub1.joinpath("test_in_sub1.py").write_text(
            "def test_1(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bbcce06e7f9b939 — Filesystem access.

pkgs/python/[email protected]/testing/python/metafunc.py:1606

        sub2.joinpath("test_in_sub2.py").write_text(
            "def test_2(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #969da8b59e9eef9e — Filesystem access.

pkgs/python/[email protected]/testing/test_assertion.py:1879

    a.joinpath("test_a.py").write_text("def test_a(): assert 1 == 2", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55d1ade90596dcc8 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertion.py:1880

    a.joinpath("conftest.py").write_text(
        'def pytest_assertrepr_compare(): return ["summary a"]', encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2ee74e67120b0c60 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertion.py:1884

    b.joinpath("test_b.py").write_text("def test_b(): assert 1 == 2", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57bb655ba6197969 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertion.py:1885

    b.joinpath("conftest.py").write_text(
        'def pytest_assertrepr_compare(): return ["summary b"]', encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8368b5d68183828c — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:361

        pkgdir.joinpath("__init__.py").write_text(
            "import pytest\n"
            "@pytest.fixture\n"
            "def special_asserter():\n"
            "    def special_assert(x, y):\n"
            "        assert x == y\n"
            "    return special_assert\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #950053c5390bd110 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:381

        xdir.joinpath("test_Y").joinpath("__init__.py").write_text(
            "x = 2", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5238d70b2fd4649c — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:998

        pytester.path.joinpath("__pycache__").write_text("Hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4100ded1603ed494 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:1172

        pkg.joinpath("test_blah.py").write_text(
            """
def test_rewritten():
    assert "@py_builtins" in globals()""",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #231533eef5d461c1 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:1356

        source.write_text("def test(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce79c37dcaa02dd8 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:1359

        contents = pyc.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd5994ec33c207ca — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:1382

        fn.write_text("def test(): assert True", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3680d1db842d680 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:1468

        path.joinpath("test_foo.py").write_text(
            textwrap.dedent(
                """\
                class Test(object):
                    def test_foo(self):
                        import pkgutil
                        data = pkgutil.get_data('foo.test_foo', 'data.txt')
                        assert data == b'Hey'
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b58f35c5ad33c08 — Filesystem access.

pkgs/python/[email protected]/testing/test_assertrewrite.py:1480

        path.joinpath("data.txt").write_text("Hey", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #83b572c01fb3926c — Filesystem access.

pkgs/python/[email protected]/testing/test_cacheprovider.py:64

        pytester.path.joinpath(".pytest_cache").write_text(
            "gone wrong", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8e89ef6c19d91bd — Filesystem access.

pkgs/python/[email protected]/testing/test_cacheprovider.py:1167

        p1.write_text(
            "def test_1(): assert 1\ndef test_2(): assert 1\n", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b9534c97fcc1a9c — Filesystem access.

pkgs/python/[email protected]/testing/test_cacheprovider.py:1239

        p1.write_text(
            "import pytest\n"
            "@pytest.mark.parametrize('num', [1, 2, 3])\n"
            "def test_1(num): assert num\n",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f0c7b5f263247929 — Filesystem access.

pkgs/python/[email protected]/testing/test_cacheprovider.py:1308

    assert gitignore_path.read_text(encoding="UTF-8") == msg

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c0cf266a64ad89a — Filesystem access.

pkgs/python/[email protected]/testing/test_cacheprovider.py:1311

    gitignore_path.write_text("custom", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b417527fa96977a — Filesystem access.

pkgs/python/[email protected]/testing/test_cacheprovider.py:1318

    assert gitignore_path.read_text(encoding="UTF-8") == "custom"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84623cb4d2b0bc04 — Filesystem access.

pkgs/python/[email protected]/testing/test_cacheprovider.py:1359

    assert cachedir_tag_path.read_bytes() == CACHEDIR_FILES["CACHEDIR.TAG"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51a29515a8875ef9 — Filesystem access.

pkgs/python/[email protected]/testing/test_capture.py:796

    sub1.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_runtest_setup(item):
                raise ValueError(42)
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d5ec51dab647cffd — Filesystem access.

pkgs/python/[email protected]/testing/test_capture.py:805

    sub1.joinpath("test_mod.py").write_text("def test_func1(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #326b495b49517d59 — Filesystem access.

pkgs/python/[email protected]/testing/test_capture.py:1092

        with open(tmpfile.name, "rb") as stmp_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04901b289c49b595 — Filesystem access.

pkgs/python/[email protected]/testing/test_capture.py:1624

    with open("caplog", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a448d0de82d3831 — Filesystem access.

pkgs/python/[email protected]/testing/test_capture.py:1631

    with open("capstdout", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bae42e12edb17642 — Filesystem access.

pkgs/python/[email protected]/testing/test_collect_imported_tests.py:16

    src_file.write_text(
        textwrap.dedent("""\
            class Testament:
                def test_collections(self):
                    pass

            def test_testament(): pass
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ee1ed5fd067a615 — Filesystem access.

pkgs/python/[email protected]/testing/test_collect_imported_tests.py:28

    test_file.write_text(
        textwrap.dedent("""\
            from foo import Testament, test_testament

            class TestDomain:
                def test(self):
                    testament = Testament()
                    assert testament
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #551d9c3fcce0ebdf — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:151

            x.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b7ed5de5f84f6fa — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:170

        testfile.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #37e0f72683bb5c3e — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:189

        testfile.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0214ebda23225f88 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:214

        ensure_file(tmp_path / "mydir" / "test_hello.py").write_text(
            "def test_1(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52bbf6a269449dab — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:217

        ensure_file(tmp_path / "xyz123" / "test_2.py").write_text(
            "def test_2(): 0/0", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22ba378a143dfc68 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:220

        ensure_file(tmp_path / "xy" / "test_ok.py").write_text(
            "def test_3(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ffc412f6938ddc59 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:236

        ensure_file(tmp_path / "a" / "test_1.py").write_text(
            "def test_a(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29d8786d255f4131 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:239

        ensure_file(tmp_path / "b" / "tests" / "test_2.py").write_text(
            "def test_b(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb3a9322a36c3057 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:242

        ensure_file(tmp_path / "c" / "tests" / "test_3.py").write_text(
            "def test_c(): pass", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4e2ae22b72f2e1f — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:378

        ensure_file(sub / "test_hello.py").write_text("syntax error", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd8ca7acf0e7a7f0 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:379

        sub.joinpath("conftest.py").write_text("syntax error", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e847a9bc52daa4a — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1138

    foo_path.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def fix():
                return 1
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4bc098071d1d419a — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1149

    foo_path.joinpath("test_foo.py").write_text(
        "def test_foo(fix): assert fix == 1", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6563b4a521fe81e0 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1155

    food_path.joinpath("test_food.py").write_text(
        "def test_food(fix): assert fix == 1", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d75bb46baf28d76f — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1295

    pytester.path.joinpath("conftest.py").write_text(
        textwrap.dedent(
            f"""
            import os
            os.chdir({str(subdir)!r})
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #855f097946825867 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1331

    testmod.joinpath("__init__.py").write_text(
        "def test_func(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a66e02af788d5b35 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1334

    testmod.joinpath("test_file.py").write_text(
        "def test_func(): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17f11ce0547cbc0b — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1339

    root.joinpath("pytest.ini").write_text(
        textwrap.dedent(
            """
        [pytest]
        addopts = --pyargs
        testpaths = testmod
    """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca512577ebd0917b — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1359

    p.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """
            def pytest_sessionstart(session):
                raise Exception("pytest_sessionstart hook successfully run")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c1db997cfcacaa31 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1425

    real.write_text(
        textwrap.dedent(
            """
        def test_nodeid(request):
            # Should not contain sub/ prefix.
            assert request.node.nodeid == "test_real.py::test_nodeid"
        """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b50d906477544ad4 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1453

    dir.joinpath("test_it.py").write_text("def test_it(): pass", "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bba178dd94b804dc — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1462

    tests.joinpath("conftest.py").write_text(
        "collect_ignore = ['ignore_me']", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52ab155c178fa0e1 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1469

    ignore_me.joinpath("conftest.py").write_text(
        "assert 0, 'should_not_be_called'", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1452746cba28d66 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1480

    init.write_text("def test_init(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #25a9f829e3f5efcc — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1482

    p.write_text("def test_file(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8350484ed3000de — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1517

    init.write_text("def test_init(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8454a5894be98395 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1535

    sub.joinpath("test_file.py").write_text("def test_file(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #50e0e07260cc4e6c — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1573

    pydir.joinpath("__init__.py").write_text("assert False", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5455ff240b549084 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1780

    test_file.write_text("def test(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45f3d5cf73dfde02 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1803

    (target / "test_chain.py").write_text("def test_chain(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21923a84be68a98e — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1880

    tmp_path.joinpath("test_foo.py").write_text("def test(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1dda2d97c49a4ef2 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1905

    ensure_file(pytester.path / "test_eggs.py").write_text(
        f"print('{head}')", encoding="UTF-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af89c66fa6a9996c — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1908

    ensure_file(pytester.path / "test_ham.py").write_text(
        f"raise {exception_class.__name__}()", encoding="UTF-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #439fc14e307b0d29 — Filesystem access.

pkgs/python/[email protected]/testing/test_collection.py:1911

    ensure_file(pytester.path / "test_spam.py").write_text(
        f"print('{tail}')", encoding="UTF-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efebd1195e551ea8 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:54

        (tmp_path / filename).write_text(
            textwrap.dedent(
                f"""\
                [{section}]
                name = value
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5971b9392aa65f38 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:87

        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """\
                [pytest]
                addopts = --verbose
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #835784381bd3dfba — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:141

        pytester.path.joinpath(name).write_text(
            textwrap.dedent(
                f"""
            [{section}]
            minversion = 3.36
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #532d2ce0de806757 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:155

        pytester.path.joinpath(name).write_text(
            textwrap.dedent(
                """
            [pytest]
            minversion = "3.36"
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80a7ae9542867224 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:216

        pytest_toml.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69cd84f5ccb6c520 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:288

        sub.joinpath("tox.ini").write_text(
            textwrap.dedent(
                """
            [pytest]
            minversion = 2.0
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36525616b35aeb86 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:297

        pytester.path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """
            [pytest]
            minversion = 1.5
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ce4ccd76b443a479 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:310

        pytester.path.joinpath("pytest.ini").write_text(
            "addopts = -x", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1db0d8f64a4b0f9e — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:328

        pytester.path.joinpath("pytest.toml").write_text(
            """
            \\"
            """,
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bfd0ca705ea4dc6 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:834

        p.write_text(f"mylist = {['.', str(somepath)]}", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #170d1ee51557ad61 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:1426

        p1.write_text(
            textwrap.dedent(
                """\
                [pytest]
                name = value
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e9957daeb9efc36 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:1443

        p2.write_text(
            textwrap.dedent(
                """\
                [pytest]
                name = wrong-value
                should_not_be_set = true
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc58c4873cb72205 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:1935

        inipath.write_text(contents, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2582ba307247ac6 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:2027

        p.write_text(contents, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35a3798c88443eed — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:2142

        (tmp_path / "setup.cfg").write_text("[tool:pytest]\n", "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b3cabd76280cac4 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:2144

        (tmp_path / "myproject" / "setup.cfg").write_text("[tool:pytest]\n", "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5087e1de02d360b2 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:2164

        pytester.path.joinpath(name).write_text(
            textwrap.dedent(
                f"""
            {section}
            custom = 1.0"""
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4d3a997ef5da3ece — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:2818

        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """\
                [pytest]
                addopts = --verbose
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1482aa7678b11db6 — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:2839

        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                """\
                [pytest]
                addopts = --verbose
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e9644c1673d3ebd — Filesystem access.

pkgs/python/[email protected]/testing/test_config.py:2858

        tmp_path.joinpath("pytest.ini").write_text(
            textwrap.dedent(
                f"""\
                [pytest]
                addopts = --verbose
                {setting_name} = {TestVerbosity.SOME_OUTPUT_VERBOSITY_LEVEL}
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd227ac4fd2f6f31 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:49

        tmp_path.joinpath("adir/conftest.py").write_text(
            "a=1 ; Directory = 3", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #49fa634ff85d69c5 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:52

        tmp_path.joinpath("adir/b/conftest.py").write_text(
            "b=2 ; a = 1.5", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f46c8ff955417b3f — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:134

    tmp_path.joinpath("adir-1.0/conftest.py").write_text(
        "a=1 ; Directory = 3", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea5272a5c8dcf3ac — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:137

    tmp_path.joinpath("adir-1.0/b/conftest.py").write_text(
        "b=2 ; a = 1.5", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1406a08aa96af246 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:270

    x.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--xyz", action="store_true")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43533fae51a69639 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:298

    tmp_path.joinpath("foo", "conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def fix(): return None
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee67e47dcba9f4e9 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:308

    tmp_path.joinpath("foo", "test_it.py").write_text(
        "def test_it(fix): pass", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77f0f5fff5ed2d16 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:429

    x.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--xyz", action="store_true")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd90b87b5262667a — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:469

    ct2.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36e0ac61c1df9f9c — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:493

    sub.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest

            @pytest.fixture
            def not_needed():
                assert False, "Should not be called!"

            @pytest.fixture
            def foo():
                assert False, "Should not be called!"

            @pytest.fixture
            def bar(foo):
                return 'bar'
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #23ada3c5f8e5fd31 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:516

    subsub.joinpath("test_bar.py").write_text(
        textwrap.dedent(
            """\
            import pytest

            @pytest.fixture
            def bar():
                return 'sub bar'

            def test_event_fixture(bar):
                assert bar == 'sub bar'
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d894bd89d4c14c4 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:537

    sub.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--hello-world", action="store_true")
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b6b2097233b82362 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:547

    p.write_text("def test_hello(): pass", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b49daaa07456cf7 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:563

        package.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def fxtr():
                    return "from-package"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d89926c7c16978d7 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:574

        package.joinpath("test_pkgroot.py").write_text(
            textwrap.dedent(
                """\
                def test_pkgroot(fxtr):
                    assert fxtr == "from-package"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d60cb84bfa12e616 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:587

        swc.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
                import pytest
                @pytest.fixture
                def fxtr():
                    return "from-swc"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35ede805ccb9221f — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:598

        swc.joinpath("test_with_conftest.py").write_text(
            textwrap.dedent(
                """\
                def test_with_conftest(fxtr):
                    assert fxtr == "from-swc"
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18939a87715e907e — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:611

        snc.joinpath("test_no_conftest.py").write_text(
            textwrap.dedent(
                """\
                def test_no_conftest(fxtr):
                    assert fxtr == "from-package"   # No local conftest.py, so should
                                                    # use value from parent dir's
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cb476d3105a339e — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:685

    src.joinpath("pytest.ini").write_text("[pytest]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed4b9e32e8e69b20 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:686

    src.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def fix1(): pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7dc52ac0820d92b4 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:696

    src.joinpath("test_foo.py").write_text(
        textwrap.dedent(
            """\
            def test_1(fix1):
                pass
            def test_2(out_of_reach):
                pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9d04613e9e07b05c — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:707

    root.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            import pytest
            @pytest.fixture
            def out_of_reach(): pass
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dfe9579b1ea08f85 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:811

    sdk.joinpath("pyproject.toml").write_text(
        textwrap.dedent("""\
            [tool.pytest.ini_options]
            testpaths = ["../tests/sdk"]
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf5cad024cc6b398 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:821

    tests_sdk.joinpath("conftest.py").write_text(
        textwrap.dedent("""\
            import pytest

            @pytest.fixture(autouse=True)
            def outer_fixture():
                pass
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bb7e5214c0ae315 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:831

    tests_sdk.joinpath("test_outer.py").write_text(
        textwrap.dedent("""\
            def test_outer(request):
                fixturenames = request.fixturenames
                assert "outer_fixture" in fixturenames
                assert "inner_fixture" not in fixturenames
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f36d2b6454c99376 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:843

    inner.joinpath("conftest.py").write_text(
        textwrap.dedent("""\
            import pytest

            @pytest.fixture(autouse=True)
            def inner_fixture():
                pass
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e8141b8fea3636e — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:853

    inner.joinpath("test_inner.py").write_text(
        textwrap.dedent("""\
            def test_inner(request):
                fixturenames = request.fixturenames
                assert "outer_fixture" in fixturenames
                assert "inner_fixture" in fixturenames
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #372a6476f9e1b904 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:887

    root.joinpath("conftest.py").write_text(
        textwrap.dedent("""\
            import pytest

            @pytest.fixture
            def ancestor_fixture():
                return "from-ancestor"
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3cb29cbe196bdf4f — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:899

    sub.joinpath("pyproject.toml").write_text(
        "[tool.pytest.ini_options]\n", encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8dcc44de1ce8d2a4 — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:902

    sub.joinpath("test_it.py").write_text(
        textwrap.dedent("""\
            def test_uses_ancestor(ancestor_fixture):
                assert ancestor_fixture == "from-ancestor"
        """),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb70684e324bad0a — Filesystem access.

pkgs/python/[email protected]/testing/test_conftest.py:917

    x.joinpath("conftest.py").write_text(
        textwrap.dedent(
            """\
            def pytest_addoption(parser):
                parser.addoption("--xyz", action="store_true", required=True)
            """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #060d8a7e2a9e9784 — Filesystem access.

pkgs/python/[email protected]/testing/test_debugging.py:387

        sub_dir.joinpath("conftest").with_suffix(".py").write_text(
            "import unknown", "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21ac4134ba55828a — Filesystem access.

pkgs/python/[email protected]/testing/test_debugging.py:390

        sub_dir.joinpath("test_file").with_suffix(".py").write_text(
            "def test_func(): pass", "utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #518f35923067256d — Filesystem access.

pkgs/python/[email protected]/testing/test_doctest.py:201

        fn.write_text(doctest, encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f4b51b466a0e414e — Filesystem access.

pkgs/python/[email protected]/testing/test_doctest.py:350

        pytester.path.joinpath("hello.py").write_text(
            textwrap.dedent(
                """\
                class Fun(object):
                    @property
                    def test(self):
                        '''
                        >>> a = 1
                        >>> 1/0
                        '''
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3b4e293c210b86a — Filesystem access.

pkgs/python/[email protected]/testing/test_doctest.py:448

        pytester.path.joinpath("hello.py").write_text(
            textwrap.dedent(
                """\
                import asdalsdkjaslkdjasd
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f380492b628c91f1 — Filesystem access.

pkgs/python/[email protected]/testing/test_doctest.py:506

        p.joinpath("__init__.py").write_text(
            textwrap.dedent(
                """\
                def somefunc():
                    '''
                        >>> i = 0
                        >>> i + 1
                        2
                    '''
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ff29478a09897629 — Filesystem access.

pkgs/python/[email protected]/testing/test_doctest.py:1365

        assert Path("out").read_text("utf-8").split() == ["RUN"] * 2

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f2b1050351020e6d — Filesystem access.

pkgs/python/[email protected]/testing/test_doctest.py:1687

    not_setup_py.write_text(
        'from setuptools import setup; setup(name="foo")', encoding="utf-8"
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b52d2fcf503be14b — Filesystem access.

pkgs/python/[email protected]/testing/test_doctest.py:1696

    setup_py.write_text(f'from {mod} import setup; setup(name="foo")', "utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0776f75bafe686b8 — Environment-variable access.

pkgs/python/[email protected]/testing/test_faulthandler.py:82

                bool(os.environ.get("CI"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9bc8baccdf9107f — Environment-variable access.

pkgs/python/[email protected]/testing/test_faulthandler.py:123

    "CI" in os.environ and sys.platform == "linux" and sys.version_info >= (3, 14),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cfcffd6225f5b9ce — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:22

        fn.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b96415155cc4d232 — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:28

        fn.write_text("[pytest]\nx=1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1d06eb9603c95f57 — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:36

        fn.write_text("[pytest]\nx=1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11e6a640cea7c93d — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:44

        fn.write_text("[custom]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d51df93d8a30e3e — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:50

        fn.write_text("[custom]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #753ae4d71c4f5eee — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:56

        fn.write_text("[tool:pytest]\nx=1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #419dd98427b75edd — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:64

        fn.write_text("[pytest]", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7bfbda16c50b6dae — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:71

        fn.write_text("]invalid toml[", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f75b88297c743cf3 — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:78

        fn.write_text(
            dedent(
                """
            [build_system]
            x = 1
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1294a121f0e0332e — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:93

        fn.write_text(
            dedent(
                """
            [tool.pytest.ini_options]
            x = 1
            y = 20.0
            values = ["tests", "integration"]
            name = "foo"
            heterogeneous_array = [1, "str"]
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #84ed666a27114ebe — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:117

        fn.write_text(
            dedent(
                """
                [tool.pytest]
                minversion = "7.0"
                xfail_strict = true
                testpaths = ["tests", "integration"]
                python_files = ["test_*.py", "*_test.py"]
                verbosity_assertions = 2
                maxfail = 5
                timeout = 300.5
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d3abded4b53006c — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:150

        fn.write_text(
            dedent(
                """
            [tool.pytest]
            xfail_strict = true

            [tool.pytest.ini_options]
            minversion = "7.0"
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5545553960715fe — Filesystem access.

pkgs/python/[email protected]/testing/test_findpaths.py:168

        fn.write_text("", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1dd9250ca834f0cc — Filesystem access.

pkgs/python/[email protected]/testing/test_helpconfig.py:129

    assert "pytest_sessionstart" in p.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9ad5c973af093bf — Filesystem access.

pkgs/python/[email protected]/testing/test_junitxml.py:542

        p.write_text("def test_func(): 0/0", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #868ba05d2fdaadb1 — Filesystem access.

pkgs/python/[email protected]/testing/test_junitxml.py:1058

        pytester.path.joinpath("myfile.xyz").write_text("hello", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #79775ca8d6991312 — Filesystem access.

pkgs/python/[email protected]/testing/test_junitxml.py:1084

    text = xmlf.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ac57b507afeaa59 — Filesystem access.

pkgs/python/[email protected]/testing/test_junitxml.py:1106

    text = xmlf.read_text(encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb2604d718d21aa1 — Filesystem access.

pkgs/python/[email protected]/testing/test_link_resolve.py:58

    p.write_text(
        textwrap.dedent(
            """
        import pytest
        def test_foo():
            raise AssertionError()
        """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #19072b33ba12496b — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:169

        os.environ[key] = "world"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29920790038d1b78 — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:172

    del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b66c17855011da1e — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:175

        assert os.environ[key] == "world"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd4f01032a217bd5 — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:176

        del os.environ[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #693af689dff33d5a — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:178

        assert key not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fad89a6706401eb — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:205

    assert os.environ["XYZ123"] == "2"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46f8fa90f3921e4c — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:207

    assert "XYZ123" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #355d44efdee1ee8b — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:212

    assert name not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8285ddc2333f4731 — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:218

    os.environ[name] = "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #faad96061e319d1a — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:222

        assert name not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1eaa2ac144aeef0 — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:224

        assert os.environ[name] == "3"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f98d5c001a130a6 — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:226

        assert os.environ[name] == "1"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a716e5697dfc1d2d — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:228

        if name in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd795d76ea9c3500 — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:229

            del os.environ[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6db36b7e8e126d5e — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:257

    assert os.environ["XYZ123"] == "3-2"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8d13a4dde9b4249e — Environment-variable access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:259

    assert "XYZ123" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #90c78731aacde808 — Filesystem access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:342

    p.joinpath("a.py").write_text(
        textwrap.dedent(
            """\
        import doesnotexist

        x = 1
    """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81e7ee11c35e4fea — Filesystem access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:352

    pytester.path.joinpath("test_importerror.py").write_text(
        textwrap.dedent(
            """\
        def test_importerror(monkeypatch):
            monkeypatch.setattr('package.a.x', 2)
    """
        ),
        encoding="utf-8",
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #221b01bd77ca6d79 — Filesystem access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:466

        ns.joinpath("__init__.py").write_text(
            "__import__('pkg_resources').declare_namespace(__name__)", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27ab783c48c522a5 — Filesystem access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:471

        lib.joinpath("__init__.py").write_text(
            f"def check(): return {dirname!r}", encoding="utf-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #346afe57edfaf597 — Filesystem access.

pkgs/python/[email protected]/testing/test_monkeypatch.py:500

    modules_tmpdir.joinpath("main_app.py").write_text("app = True", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed401c0c85b8635d — Filesystem access.

pkgs/python/[email protected]/testing/test_parseopt.py:143

        args_file.write_text("\n".join(tests), encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09a769a222350266 — Filesystem access.

pkgs/python/[email protected]/testing/test_parseopt.py:311

    with open(str(script), "w", encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42945337789758dd — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:147

        samplefile.write_text("samplefile\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8090e70a8c5f16b2 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:150

        execfile.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fcddad9b10e8eb3 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:153

        execfilepy.write_text("x=42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14f3cf322b7cd021 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:167

        module_a.write_text("from .b import stuff as result\n", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a9677da0d37f1bc — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:169

        module_b.write_text('stuff="got it"\n', encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa5122004c173bb7 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:171

        module_c.write_text(
            dedent(
                """
            import pluggy;
            import otherdir.a
            value = otherdir.a.result
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16a7fdbcfe367ce5 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:182

        module_d.write_text(
            dedent(
                """
            import pluggy;
            from otherdir import a
            value2 = a.result
        """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fe6c707cbfe8e19 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:355

        fn.write_text("def foo(x): return 40 + x", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72061c2b640829bd — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:559

    module_path.write_text("def foo(): return 42", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd7cc3cb005db350 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:603

        fn.write_text(
            dedent(
                """
                from dataclasses import dataclass

                @dataclass
                class Data:
                    value: str
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09ef4832bd86b209 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:636

        fn.write_text(
            dedent(
                """
                import pickle

                def _action():
                    return 42

                def round_trip():
                    s = pickle.dumps(_action)
                    return pickle.loads(s)
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #778be06ece383437 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:674

        fn1.write_text(
            dedent(
                """
                import dataclasses
                import pickle

                @dataclasses.dataclass
                class Data:
                    x: int = 42
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6ab053f850cbea50 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:690

        fn2.write_text(
            dedent(
                """
                import dataclasses
                import pickle

                @dataclasses.dataclass
                class Data:
                    x: str = ""
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28ae0c0a98688e35 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:821

        file_path.write_text("my_name='demo'", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f6feb5d93990998 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:824

            (tmp_path / "a/b/__init__.py").write_text(
                "my_name='b.__init__'", encoding="utf-8"
            )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28ab2e847d7c69f6 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:890

        init.write_text(
            dedent(
                """
                from .singleton import Singleton

                instance = Singleton()
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c35671f32db2969a — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:901

        singleton.write_text(
            dedent(
                """
                class Singleton:
                    INSTANCES = []

                    def __init__(self) -> None:
                        self.INSTANCES.append(self)
                        if len(self.INSTANCES) > 1:
                            raise RuntimeError("Already initialized")
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e0b99615b76e7a88 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:955

        file_path.write_text(
            dedent(
                """
            def test_demo():
                pass
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #03446f0a9b388707 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:992

        core_py.write_text(
            dedent(
                """
                def foo():
                    '''
                    >>> 1 + 1
                    2
                    '''
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a8ec6a4a7873cb7c — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1019

        conftest_path1.write_text(
            dedent(
                """
                import pytest
                @pytest.fixture
                def a_fix(): return "a"
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f3b3177692c93cfe — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1030

        test_path1.write_text(
            dedent(
                """
                import app.core
                def test(a_fix):
                    assert a_fix == "a"
                """,
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #158acee448d8c221 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1043

        conftest_path2.write_text(
            dedent(
                """
                import pytest
                @pytest.fixture
                def b_fix(): return "b"
                """
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a7e8234c7275daf2 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1055

        test_path2.write_text(
            dedent(
                """
                import app.core
                def test(b_fix):
                    assert b_fix == "b"
                """,
            ),
            encoding="ascii",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92245039e39a88bf — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1175

        x_at_root.write_text("raise AssertionError('x at root')", encoding="ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20522cf5fc5ce40a — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1181

        x_in_sub_dir.write_text("X = 'a/b/x'", encoding="ascii")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e4080f3ee8d5a2a — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1400

        (tmp_path / "src/dist1/com/company/app/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61aed63557972bc7 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1403

        (tmp_path / "src/dist1/com/company/app/core/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3eed0975be8f7a7b — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1410

        (tmp_path / "src/dist2/com/company/calc/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #996fb0500ff1c303 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1413

        (tmp_path / "src/dist2/com/company/calc/algo/__init__.py").write_text(
            code, encoding="UTF-8"
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4ecd67e07bd80f8 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1417

        algorithms_py.write_text(code, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b363b4f38d98950 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1503

        test_py.write_text(code, encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7abf000a19798d18 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1532

        file.write_text("data=123", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #221e161a4c82ef7b — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1537

        tests.write_text(
            dedent(
                """
            from cow.moo.moo import data

            def test_moo():
                print(data)
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #734c64393a42bb58 — Filesystem access.

pkgs/python/[email protected]/testing/test_pathlib.py:1693

    test_y.write_text("def test(): pass", encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b172bdaf9535d4e — Environment-variable access.

pkgs/python/[email protected]/testing/test_pluginmanager.py:351

        monkeypatch.setitem(os.environ, "PYTEST_PLUGINS", "xy123")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #839b80fac8a2ae05 — Filesystem access.

pkgs/python/[email protected]/testing/test_pluginmanager.py:409

        pytester.mkpydir("pkg").joinpath("plug.py").write_text("x=3", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf757f74440bd21f — Filesystem access.

pkgs/python/[email protected]/testing/test_pytester.py:218

    assert "mixed_encoding = 'São Paulo'".encode() in p.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c3f5a27e87108ff — Filesystem access.

pkgs/python/[email protected]/testing/test_pytester.py:227

        test_mod.write_text("def test_foo(): assert False", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ecab68ae5eb91c2 — Environment-variable access.

pkgs/python/[email protected]/testing/test_pytester.py:613

    assert "PYTEST_ADDOPTS" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eec3a8d3d4d5143b — Environment-variable access.

pkgs/python/[email protected]/testing/test_pytester.py:705

    assert os.environ.get("HOME") == tmphome

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f647d01118f7d374 — Filesystem access.

pkgs/python/[email protected]/testing/test_python_path.py:38

    foo_py.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2eda4f1d745cd91a — Filesystem access.

pkgs/python/[email protected]/testing/test_python_path.py:47

    bar_py.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1670bc626f59f3d7 — Filesystem access.

pkgs/python/[email protected]/testing/test_python_path.py:76

    localplugin_py.write_text(content, encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e123236c14b07e72 — Filesystem access.

pkgs/python/[email protected]/testing/test_reports.py:411

        sub_dir.joinpath("conftest.py").write_text("import unknown", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ccb51190e2809290 — Environment-variable access.

pkgs/python/[email protected]/testing/test_runner.py:1086

    assert "PYTEST_CURRENT_TEST" not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e129fc260857aad — Environment-variable access.

pkgs/python/[email protected]/testing/test_runner.py:1225

    assert os.environ["PYTEST_VERSION"] == "old version"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b421265209a4a83b — Filesystem access.

pkgs/python/[email protected]/testing/test_session.py:273

    hellodir.joinpath("test_hello.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c5c0ffa10a94859e — Filesystem access.

pkgs/python/[email protected]/testing/test_session.py:275

    hello2dir.joinpath("test_hello2.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57128cbdc2ed091e — Filesystem access.

pkgs/python/[email protected]/testing/test_session.py:284

    hellodir.joinpath("test_hello.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c0973f46f466dad — Filesystem access.

pkgs/python/[email protected]/testing/test_session.py:286

    hello2dir.joinpath("test_hello2.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0e2ad933779c6f9 — Filesystem access.

pkgs/python/[email protected]/testing/test_session.py:288

    hello3dir.joinpath("test_hello3.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18589cbc54a59349 — Filesystem access.

pkgs/python/[email protected]/testing/test_session.py:290

    subdir.joinpath("test_hello4.py").write_text("x y syntaxerror", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ab4fe16e6b6aa0a — Filesystem access.

pkgs/python/[email protected]/testing/test_skipping.py:191

        root.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            def pytest_markeval_namespace():
                return {"arg": "root"}
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0d73696b487a769 — Filesystem access.

pkgs/python/[email protected]/testing/test_skipping.py:202

        root.joinpath("test_root.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            @pytest.mark.skipif("arg == 'root'")
            def test_root():
                assert False
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72a98904192fa5ba — Filesystem access.

pkgs/python/[email protected]/testing/test_skipping.py:217

        foo.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            def pytest_markeval_namespace():
                return {"arg": "foo"}
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0713cfea899b9a72 — Filesystem access.

pkgs/python/[email protected]/testing/test_skipping.py:228

        foo.joinpath("test_foo.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            @pytest.mark.skipif("arg == 'foo'")
            def test_foo():
                assert False
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ebe0809eed0118d1 — Filesystem access.

pkgs/python/[email protected]/testing/test_skipping.py:243

        bar.joinpath("conftest.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            def pytest_markeval_namespace():
                return {"arg": "bar"}
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #212e295238a2946e — Filesystem access.

pkgs/python/[email protected]/testing/test_skipping.py:254

        bar.joinpath("test_bar.py").write_text(
            textwrap.dedent(
                """\
            import pytest

            @pytest.mark.skipif("arg == 'bar'")
            def test_bar():
                assert False
            """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f0942aeafca57a8a — Filesystem access.

pkgs/python/[email protected]/testing/test_stepwise.py:534

    cache_file.write_text(json.dumps({"invalid": True}), encoding="UTF-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6769a86ba4104ca — Filesystem access.

pkgs/python/[email protected]/testing/test_terminal.py:271

        a.joinpath("test_hello123.py").write_text(
            textwrap.dedent(
                """\
                class TestClass(object):
                    def test_method(self):
                        pass
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3efb80b882ecb4d9 — Filesystem access.

pkgs/python/[email protected]/testing/test_terminal.py:1645

        pytester.mkdir("a").joinpath("conftest.py").write_text(
            """
def pytest_report_header(config, start_path):
    return ["line1", str(start_path)]
""",
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d73f35ee65365616 — Filesystem access.

pkgs/python/[email protected]/testing/test_terminal.py:3386

        test_path.write_text(
            textwrap.dedent(
                """
                import pytest

                @pytest.mark.parametrize("a", ["x/y", "C:/path", "\\\\", "C:\\\\path", "a::b/"])
                def test_x(a):
                    assert False
                """
            ),
            encoding="utf-8",
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-docx

python dependency

expand_more 7 low-confidence finding(s)

low env_fs dependency Excluded from app score #421c8ac1b996d3ca — Filesystem access.

pkgs/python/[email protected]/src/docx/image/image.py:41

            with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6befaae4f975b186 — Filesystem access.

pkgs/python/[email protected]/src/docx/opc/phys_pkg.py:47

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec5fdccf1709f011 — Filesystem access.

pkgs/python/[email protected]/src/docx/parts/comments.py:49

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #efb620c9bfc7998d — Filesystem access.

pkgs/python/[email protected]/src/docx/parts/hdrftr.py:31

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d464c246adc74f86 — Filesystem access.

pkgs/python/[email protected]/src/docx/parts/hdrftr.py:51

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #818ea94c3c3b3559 — Filesystem access.

pkgs/python/[email protected]/src/docx/parts/settings.py:48

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df79cd2d3ec13193 — Filesystem access.

pkgs/python/[email protected]/src/docx/parts/styles.py:40

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-dotenv

python dependency

expand_more 11 low-confidence finding(s)

low env_fs dependency Excluded from app score #cf25e38eb18366e0 — Filesystem access.

pkgs/python/[email protected]/src/dotenv/cli.py:76

        with open(path) as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #783f8f2cf577e569 — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/cli.py:194

        if v is not None and (override or k not in os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #69f5ef9b115e399b — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/cli.py:225

    cmd_env = os.environ.copy()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35f97682ef3cacc5 — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/main.py:26

    if "PYTHON_DOTENV_DISABLED" not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bd742884cc8fa84 — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/main.py:28

    value = os.environ["PYTHON_DOTENV_DISABLED"].casefold()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #14a0dce9402151f0 — Filesystem access.

pkgs/python/[email protected]/src/dotenv/main.py:63

            with open(self.dotenv_path, encoding=self.encoding) as stream:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42c8b56d389bf339 — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/main.py:105

            if k in os.environ and not self.override:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b738037890a3b5d4 — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/main.py:108

                os.environ[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48251b18b203129a — Filesystem access.

pkgs/python/[email protected]/src/dotenv/main.py:148

        source: IO[str] = open(path, encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12e2e021614037ad — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/main.py:302

                env.update(os.environ)  # type: ignore

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #359a3c78174ea0a8 — Environment-variable access.

pkgs/python/[email protected]/src/dotenv/main.py:306

                env.update(os.environ)  # type: ignore

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-multipart

python dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #0e33314bf18be576 — Filesystem access.

pkgs/python/[email protected]/python_multipart/multipart.py:516

                tmp_file = open(path, "w+b")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

python-pptx

python dependency

expand_more 13 low-confidence finding(s)

low env_fs dependency Excluded from app score #1873875679310af2 — Filesystem access.

pkgs/python/[email protected]/features/steps/picture.py:43

    with open(test_image(filename), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f7c802c6f0e45f7 — Filesystem access.

pkgs/python/[email protected]/features/steps/placeholder.py:141

    with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ceed0e6c636fabe — Filesystem access.

pkgs/python/[email protected]/features/steps/presentation.py:88

    with open(test_pptx("test"), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31c2fb74053f6e2f — Filesystem access.

pkgs/python/[email protected]/features/steps/presentation.py:107

    with open(saved_pptx_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0fe454cbc682e5d — Filesystem access.

pkgs/python/[email protected]/features/steps/shape.py:461

    with open(test_file("just-two-mice.png"), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77da430f98b4e030 — Filesystem access.

pkgs/python/[email protected]/features/steps/shapes.py:65

    with open(test_file(filename), "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29d086be4ac733aa — Filesystem access.

pkgs/python/[email protected]/src/pptx/media.py:37

            with open(movie_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ea5e3891578fe69d — Filesystem access.

pkgs/python/[email protected]/src/pptx/opc/package.py:367

            with open(file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16b8b84d8fc6cfc4 — Filesystem access.

pkgs/python/[email protected]/src/pptx/opc/serialized.py:166

            with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd0901d8cd2b6bf3 — Filesystem access.

pkgs/python/[email protected]/src/pptx/oxml/__init__.py:29

    with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b79d835ecd160e41 — Filesystem access.

pkgs/python/[email protected]/src/pptx/parts/image.py:163

            with open(image_file, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8ef6abc7eab584e — Environment-variable access.

pkgs/python/[email protected]/src/pptx/text/fonts.py:80

        home = os.environ.get("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82275c728fdc08dc — Filesystem access.

pkgs/python/[email protected]/src/pptx/text/fonts.py:200

        return cls(open(path, "rb"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pytz

python dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #942c259084e353fe — Environment-variable access.

pkgs/python/[email protected]/pytz/__init__.py:91

    zoneinfo_dir = os.environ.get('PYTZ_TZDATADIR', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53d28e751e24d4e3 — Filesystem access.

pkgs/python/[email protected]/pytz/__init__.py:118

    return open(filename, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e263e216ea2abeec — Environment-variable access.

pkgs/python/[email protected]/pytz/__init__.py:124

        if os.environ.get('PYTZ_SKIPEXISTSCHECK', ''):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1e21c511dcb9a643 — Filesystem access.

pkgs/python/[email protected]/pytz/tzfile.py:130

                      open(os.path.join(base, 'Australia', 'Melbourne'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d6d16945614132a9 — Filesystem access.

pkgs/python/[email protected]/pytz/tzfile.py:132

                      open(os.path.join(base, 'US', 'Eastern'), 'rb'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e20863098783558f — Filesystem access.

pkgs/python/[email protected]/setup.py:31

    long_description=open('README.rst', 'r').read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

qdrant-client

python dependency

expand_more 13 low-confidence finding(s)

low egress dependency Excluded from app score #37255e0781b0c057 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/qdrant_client/common/version_check.py:15

    response = httpx.get(rest_uri, headers=rest_headers, auth=auth_provider, timeout=timeout)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #539a377b358dd693 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/embed/schema_parser.py:298

        with open(output_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3e28c0470158fb2 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/embed/utils.py:76

    with open(path, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c0805fd1d87d2761 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:99

            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7559585a05dc1a7c — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:102

            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f1ce9458d8b2d3c — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:125

            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e42cba01fa76c27 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:127

        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #906ab487e6db065d — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/async_qdrant_local.py:146

        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9cc219aaeec28cc0 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:102

            with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed8f7bf13c3b39a2 — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:105

            with open(meta_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #29b19b939bc5262a — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:136

            with open(lock_file_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e093c0495d9cc9b — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:138

        self._flock_file = open(lock_file_path, "r+")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8e664f3de9d45af — Filesystem access.

pkgs/python/[email protected]/qdrant_client/local/qdrant_local.py:162

        with open(meta_path, "w") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ruff

python dependency

expand_more 10 low-confidence finding(s)

low env_fs dependency Excluded from app score #fba9ea8fab77e44c — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_ast/generate.py:1171

    out_path.write_text(rustfmt("\n".join(out)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #055ce433ab5517b6 — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_formatter/generate.py:24

nodes_file = (
    root.joinpath("crates")
    .joinpath("ruff_python_ast")
    .joinpath("src")
    .joinpath("generated.rs")
    .read_text()
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06927ecf98a0ed4e — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_formatter/generate.py:118

        node_path.write_text(rustfmt(code))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9b1e61609cb3feea — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_formatter/generate.py:176

out.write_text(rustfmt(generated))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e6a5db101457cc47 — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_parser/resources/inline/err/debug_shadow_with.py:1

with open("foo.txt") as __debug__: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51941615bf31f8b0 — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_parser/resources/inline/ok/single_parenthesized_item_context_manager_py38.py:2

with (
  open('foo.txt')) as foo: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a4e7743ead098ad — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_parser/resources/inline/ok/single_parenthesized_item_context_manager_py38.py:4

with (
  open('foo.txt')): ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4690fdb1fcee53a — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_parser/resources/valid/statement/ambiguous_lpar_with_items.py:61

with (open('a.py')), (open('b.py')): ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08cb0aaf4e3604a8 — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_parser/resources/valid/statement/with.py:13

with open() as f: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6475afae1bc84860 — Filesystem access.

pkgs/python/[email protected]/crates/ruff_python_parser/resources/valid/statement/with.py:14

with open() as f.attr: ...

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

setuptools

python dependency

expand_more 163 low-confidence finding(s)

low env_fs dependency Excluded from app score #8951d582f2c4309a — Environment-variable access.

pkgs/python/[email protected]/_distutils_hack/__init__.py:49

    which = os.environ.get('SETUPTOOLS_USE_DISTUTILS', 'local')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7da857f6d7c02770 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/command/_framework_compat.py:22

    ensurepip = os.environ.get("ENSUREPIP_OPTIONS")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #acf3528689440794 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/bdist_rpm.py:555

                    with open(val) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #268a5f412a126490 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/command/build_ext.py:800

                elif '_PYTHON_HOST_PLATFORM' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #591df6f435b332f1 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/build_scripts.py:105

            with open(outfile, "w", encoding=f.encoding) as outf:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #16c1cdc776559adc — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/config.py:104

        with open(filename, "w", encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f6bd186ad622be5 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/config.py:191

        with open(out, encoding='utf-8') as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9714574f977b462d — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/config.py:348

    log.info(pathlib.Path(filename).read_text(encoding='utf-8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58b3994101260b03 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/install_egg_info.py:55

        with open(target, 'w', encoding='UTF-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c59242476fa8de0 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/sdist.py:424

        with open(self.manifest, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7aa3bd294586a35 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/command/sdist.py:434

        with open(self.manifest, encoding='utf-8') as lines:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #05b48993a0a9372f — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/cygwin.py:73

        self.cc = os.environ.get('CC', self.cc or 'gcc')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f41d113c3394f912 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/cygwin.py:74

        self.cxx = os.environ.get('CXX', self.cxx or 'g++')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac17002f0da25120 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/cygwin.py:318

        config_h = pathlib.Path(fn).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #18dec79507296acd — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:82

    root = os.environ.get("ProgramFiles(x86)") or os.environ.get("ProgramFiles")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #45fbfb60cec6ee39 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:151

    if os.getenv("DISTUTILS_USE_SDK"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ccdbf4cddf3a526 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:152

        return {key.lower(): value for key, value in os.environ.items()}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb4191ed82904217 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:190

        paths = os.getenv('path').split(os.pathsep)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c78a0a11a359b9fe — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/msvc.py:562

        env = dict(os.environ, PATH=self._paths)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6fa45422875168fb — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/compilers/C/zos.py:114

            if (binary := os.environ.get(envvar, None))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a84d5424c19f125a — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/debug.py:5

DEBUG = os.environ.get('DISTUTILS_DEBUG')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7fc3c9bb4370b891 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/dist.py:387

            yield pathlib.Path(os.getenv("DIST_EXTRA_CONFIG"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11f5cfe940647445 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/dist.py:1141

            self.read_pkg_file(open(path))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad96fd6e201210fe — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/dist.py:1216

        with open(
            os.path.join(base_dir, 'PKG-INFO'), 'w', encoding='UTF-8'
        ) as pkg_info:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #650d644f1c435625 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/file_util.py:28

            fsrc = open(src, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fafd2e569b449f2f — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/file_util.py:39

            fdst = open(dst, 'wb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1b89079da207a5c — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/file_util.py:227

    with open(filename, 'w', encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e391ec3b5762a1d3 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/spawn.py:52

    return os.environ if env is None else env

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d2e37addec73e38a — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/spawn.py:111

        path = os.environ.get('PATH', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6d1536a476678ace — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:48

if "_PYTHON_PROJECT_BASE" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #877d4cbed7cbec14 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:49

    project_base = os.path.abspath(os.environ["_PYTHON_PROJECT_BASE"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #104c354cad70b8e1 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:330

        if 'CC' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c13b2b15c9ab35b5 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:331

            newcc = os.environ['CC']

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a0e66f154c0cf1d6 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:332

            if 'LDSHARED' not in os.environ and ldshared.startswith(cc):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #208f8471cd92931f — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:337

        cxx = os.environ.get('CXX', cxx)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #939be2b4e1f0c624 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:338

        ldshared = os.environ.get('LDSHARED', ldshared)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2e8b44c6b97f66c8 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:339

        ldcxxshared = os.environ.get('LDCXXSHARED', ldcxxshared)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fc6025b7c79a31ac — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:340

        cpp = os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #35dc9fc189d5e110 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:340

        cpp = os.environ.get(
            'CPP',
            cc + " -E",  # not always
        )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6c65e221acc6a552 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:347

        cflags = os.environ.get('CFLAGS', cflags)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1ee98d7e85a68133 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:349

        cxxflags = os.environ.get('CXXFLAGS', cxxflags)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #906bda3e35690477 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:357

        ar = os.environ.get('AR', ar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e4aa9418183f7632 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:359

        archiver = ar + ' ' + os.environ.get('ARFLAGS', ar_flags)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39d6beb73ce6e026 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:376

        if 'RANLIB' in os.environ and compiler.executables.get('ranlib', None):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66c4d68b8a525b95 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:377

            compiler.set_executables(ranlib=os.environ['RANLIB'])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5cf2ed5c9fff07ee — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:472

                elif n in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e89f4a6df301cbb3 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:474

                    item = os.environ[n]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db6db903d6662a9d — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/sysconfig.py:597

    flags = os.environ.get(f'{type}FLAGS')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c8b9a175b1ac2fb1 — Filesystem access.

pkgs/python/[email protected]/setuptools/_distutils/text_file.py:118

        self.file = open(self.filename, errors=self.errors, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f63d13deb366eb03 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/util.py:57

        target = os.environ.get('VSCMD_ARG_TGT_ARCH')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f02680b4f88a5247 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/util.py:94

    env_ver = os.environ.get(MACOSX_VERSION_VAR)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e941b77752423f5 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/util.py:174

    if os.name == 'posix' and 'HOME' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2c65c5c5e780eb36 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/util.py:178

            os.environ['HOME'] = pwd.getpwuid(os.getuid())[5]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48726f183196ec0c — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/util.py:184

    if 'PLAT' not in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eeb13f3960c722a7 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/util.py:185

        os.environ['PLAT'] = get_platform()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #653f39201427c9e4 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_distutils/util.py:199

    lookup = dict(os.environ)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1c7ee32cbddcfb19 — Filesystem access.

pkgs/python/[email protected]/setuptools/_imp.py:65

            file = open(path, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ded9f21366d18415 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_path.py:80

    orig_pythonpath = os.environ.get('PYTHONPATH', nothing)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7102f9fbe4e81edf — Environment-variable access.

pkgs/python/[email protected]/setuptools/_path.py:81

    current_pythonpath = os.environ.get('PYTHONPATH', '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d6a98b30d4d415d — Environment-variable access.

pkgs/python/[email protected]/setuptools/_path.py:87

            os.environ['PYTHONPATH'] = new_path

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f23d487a345a570 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_path.py:91

            os.environ.pop('PYTHONPATH', None)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3ce4f63f9e0b8671 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_path.py:93

            os.environ['PYTHONPATH'] = orig_pythonpath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf410817a6206005 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_scripts.py:49

        return os.environ.get('__PYVENV_LAUNCHER__', _default)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9781c6fd9ef06a7 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_scripts.py:238

        launcher = os.environ.get('SETUPTOOLS_LAUNCHER', 'executable')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17caee4982c97f0f — Environment-variable access.

pkgs/python/[email protected]/setuptools/_scripts.py:245

        if ext not in os.environ['PATHEXT'].lower().split(';'):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #66ed33564f11ad8f — Filesystem access.

pkgs/python/[email protected]/setuptools/_scripts.py:332

    return resources.files('setuptools').joinpath(launcher_fn).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aef9b12f43d0143b — Filesystem access.

pkgs/python/[email protected]/setuptools/_scripts.py:337

    return res.read_text(encoding='utf-8') % vars()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b03189299aab9070 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/autocommand/autoparse.py:330

        with open(filename_or_file, *args, **kwargs) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fbda9ed336e78ca5 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/backports/tarfile/__init__.py:2829

            t = open(fileobj=name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #919eb3c000a94a53 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/backports/tarfile/__init__.py:2832

            t = open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #358af5686e4b8b73 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/backports/tarfile/__init__.py:2872

            with open(src, 'r') as tar:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d86ddd0fe69e2583 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:379

        return self.locate().read_text(encoding=encoding)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #71a77ff270af70bb — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:382

        return self.locate().read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9186e9fc812b92f6 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:527

            self.read_text('METADATA')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d1f10a61e84337c — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:528

            or self.read_text('PKG-INFO')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9c584697a5f5aa06 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:532

            or self.read_text('')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b7280c9ed9d3856 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:567

        return EntryPoints._from_text_for(self.read_text('entry_points.txt'), self)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #de0f55f30f232b2d — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:616

        text = self.read_text('RECORD')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c220da777026e286 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:630

        text = self.read_text('installed-files.txt')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62f64e89f19bc20e — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:659

        text = self.read_text('SOURCES.txt')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28bbaaa11f23fbc3 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:672

        source = self.read_text('requires.txt')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #93c7de56b32aa44f — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:723

            self.read_text(filename),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #87552b1aca32e387 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:1014

            return self._path.joinpath(filename).read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f41849bb3b61e781 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/importlib_metadata/__init__.py:1150

    return (dist.read_text('top_level.txt') or '').split()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #2438939f20521887 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/setuptools/_vendor/jaraco/context/__init__.py:78

        req = urllib.request.urlopen(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #ea4d7d5f90684c68 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/jaraco/text/__init__.py:232

lorem_ipsum: str = (
    files(__name__).joinpath('Lorem ipsum.txt').read_text(encoding='utf-8')
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a6d7ff1d9d744f1a — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/jaraco/text/__init__.py:631

    with open(filename, encoding='utf-8') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ba20b8ba92917c75 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/packaging/_manylinux.py:34

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b77e1fac2fb9cbc5 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/packaging/_musllinux.py:46

        with open(executable, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ec590570c8d4993 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/__init__.py:31

    if os.getenv("ANDROID_DATA") == "/data" and os.getenv("ANDROID_ROOT") == "/system":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3527dd118ff73964 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/__init__.py:32

        if os.getenv("SHELL") or os.getenv("PREFIX"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a582922fc153a05 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:45

        path = os.environ.get("XDG_DATA_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ee043e48ec85879 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:52

        path = os.environ.get("XDG_DATA_DIRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #419e893fa7b3f9b0 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:76

        path = os.environ.get("XDG_CONFIG_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d48bfea0a40055bb — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:83

        path = os.environ.get("XDG_CONFIG_DIRS", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe4f350ec5dff7c9 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:107

        path = os.environ.get("XDG_CACHE_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #649e790b702fbdad — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:123

        path = os.environ.get("XDG_STATE_HOME", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04e4eabfd24620b3 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:177

        path = os.environ.get("XDG_RUNTIME_DIR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08996cba3d964077 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:201

        path = os.environ.get("XDG_RUNTIME_DIR", "")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #04b62e251319fb9e — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/unix.py:238

        media_dir = os.environ.get(env_var, "").strip()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63a25002f0c44236 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:157

    result = os.environ.get(env_var_name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b0c5b54411be6709 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:167

        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Documents")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fba965858374d8b6 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:170

        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Downloads")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #494b67dc524c1239 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:173

        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Pictures")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #172836a7f9d5ef67 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:176

        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Videos")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #af820b8e8f163c30 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/platformdirs/windows.py:179

        return os.path.join(os.path.normpath(os.environ["USERPROFILE"]), "Music")  # noqa: PTH118

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #96c10870a3198e10 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_bdist_wheel.py:492

        with open(wheelfile_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #689daa11ee848cc4 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_bdist_wheel.py:598

            with open(dependency_links_path, encoding="utf-8") as dependency_links_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f95b0b68efd7d38 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_bdist_wheel.py:609

        with open(pkg_info_path, "w", encoding="utf-8") as out:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5dc9ff3fffa431da — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:171

                        requires = path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #11c46d40ee273492 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:174

                        pkginfo = path.read_text("utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #12dd665c2d6a3132 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:184

                            path.read_bytes(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4784c0d5dae571e6 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/convert.py:190

                yield str(path.relative_to(self.path)), path.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67ac779527ec5c22 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/pack.py:40

    with open(wheel_file_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c33f15e79e7e178 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_commands/pack.py:60

            with open(wheel_file_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #31aa09048fb9a8b3 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_metadata.py:151

    with open(pkginfo_path, encoding="utf-8") as headers:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43a36296e2591bbf — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/_metadata.py:160

        with open(requires_path, encoding="utf-8") as requires_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39efea5856990599 — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:293

    with open(path_to_lib, "rb") as lib_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #298c44154081a93d — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:419

    if "MACOSX_DEPLOYMENT_TARGET" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae7e6c6da4f9c164 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:421

            int(x) for x in os.environ["MACOSX_DEPLOYMENT_TARGET"].split(".")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ab028f498966ff3 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/macosx_libfile.py:474

        if "MACOSX_DEPLOYMENT_TARGET" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #718906e19b8bcb13 — Environment-variable access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/wheelfile.py:53

    timestamp = int(os.environ.get("SOURCE_DATE_EPOCH", timestamp or time.time()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28fe8ce33c5aff2d — Filesystem access.

pkgs/python/[email protected]/setuptools/_vendor/wheel/wheelfile.py:185

        with open(filename, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #957d587f45d9a07b — Filesystem access.

pkgs/python/[email protected]/setuptools/archive_util.py:133

            with open(target, 'wb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ebe1ac9e7cd9b32a — Filesystem access.

pkgs/python/[email protected]/setuptools/command/bdist_egg.py:71

    with open(pyfile, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f190f91c9153d0a — Filesystem access.

pkgs/python/[email protected]/setuptools/command/bdist_egg.py:212

            with open(native_libs, 'wt', encoding="utf-8") as libs_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63d96a70507ffbe3 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/bdist_egg.py:363

            with open(fn, 'wt', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8125589873c4f5ca — Filesystem access.

pkgs/python/[email protected]/setuptools/command/bdist_egg.py:382

    f = open(filename, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #55af1b73d601be29 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/bdist_wheel.py:475

        with open(wheelfile_path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b33fff1353483b72 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/bdist_wheel.py:575

        with open(dependency_links_path, encoding="utf-8") as dependency_links_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #33c9b125ef2b048d — Environment-variable access.

pkgs/python/[email protected]/setuptools/command/build_ext.py:160

        so_ext = os.getenv('SETUPTOOLS_EXT_SUFFIX')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9812cc02e33e7107 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/build_ext.py:354

        with open(stub_file, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47ed6c4cf9adca98 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/build_py.py:192

            files = manifest.read_text(encoding="utf-8").splitlines()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9120564fda83859 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/build_py.py:261

        with open(init_py, 'rb') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4f39b513aceb907e — Environment-variable access.

pkgs/python/[email protected]/setuptools/command/easy_install.py:18

            sys_executable=os.environ.get(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4854d3118f2e57e8 — Environment-variable access.

pkgs/python/[email protected]/setuptools/command/easy_install.py:18

            sys_executable=os.environ.get(
                "__PYVENV_LAUNCHER__", os.path.normpath(sys.executable)
            ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3e1d778affda6799 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/editable_wheel.py:601

        path1.write_text("file1", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8b82712c8bb32e2 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/editable_wheel.py:604

            if path2.is_symlink() and path2.read_text(encoding="utf-8") == "file1":

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e073ee38432e5528 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/egg_info.py:309

        f = open(filename, 'wb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ef7bc046db966774 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/egg_info.py:671

    with open(filename, "wb") as f:  # always write POSIX-style manifest

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5fcd5ec658dffde5 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/install_scripts.py:64

        with open(target, "w" + mode, encoding=encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f86bf9f683874117 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/sdist.py:195

        with open(self.manifest, 'rb') as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fde05771acc183b3 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/sdist.py:205

        manifest = open(self.manifest, 'rb')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1734b5de8501bf91 — Filesystem access.

pkgs/python/[email protected]/setuptools/command/setopt.py:67

    with open(filename, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00115b4e8695f008 — Environment-variable access.

pkgs/python/[email protected]/setuptools/config/_validate_pyproject/error_reporting.py:81

        debug_code = os.getenv("JSONSCHEMA_DEBUG_CODE_GENERATION", "false").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #1e5ee1fb8b23ac6f — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/setuptools/config/_validate_pyproject/formats.py:158

    with urlopen(url, context=context) as response:  # noqa: S310 (audit URLs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #00792002aef3ced2 — Environment-variable access.

pkgs/python/[email protected]/setuptools/config/_validate_pyproject/formats.py:192

        if os.getenv("NO_NETWORK") or os.getenv("VALIDATE_PYPROJECT_NO_NETWORK"):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9144cbe39d69910b — Filesystem access.

pkgs/python/[email protected]/setuptools/config/expand.py:57

        module = ast.parse(pathlib.Path(spec.origin).read_bytes())  # type: ignore[arg-type] # Let it raise an error on None

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1cf134e99c248a68 — Filesystem access.

pkgs/python/[email protected]/setuptools/config/expand.py:142

    with open(filepath, encoding='utf-8') as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3bb62227bd5cb6c — Filesystem access.

pkgs/python/[email protected]/setuptools/config/pyprojecttoml.py:39

    with open(filepath, "rb") as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #28fc2ad323992c06 — Filesystem access.

pkgs/python/[email protected]/setuptools/dist.py:586

            with open(filename, encoding='utf-8') as reader:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #174c0e883c520200 — Filesystem access.

pkgs/python/[email protected]/setuptools/dist.py:820

            with open(readme_txt_filename, 'w', encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #174b9a238d2cee5d — Environment-variable access.

pkgs/python/[email protected]/setuptools/installer.py:82

    quiet = 'PIP_QUIET' not in os.environ and 'PIP_VERBOSE' not in os.environ

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7c3f11648703f8c4 — Environment-variable access.

pkgs/python/[email protected]/setuptools/installer.py:83

    if 'PIP_INDEX_URL' in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bf3997dbe79e8f32 — Filesystem access.

pkgs/python/[email protected]/setuptools/msvc.py:462

                with open(state_path, 'rt', encoding='utf-8') as state_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b03ac0bd1b94c914 — Filesystem access.

pkgs/python/[email protected]/setuptools/namespaces.py:23

        with open(filename, 'wt', encoding=py312.PTH_ENCODING) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #21f06f3f3c0082d1 — Filesystem access.

pkgs/python/[email protected]/setuptools/unicode_utils.py:73

        with open(file, "r", encoding="utf-8") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d68414f2ef10d577 — Filesystem access.

pkgs/python/[email protected]/setuptools/unicode_utils.py:77

        with open(file, "r", encoding=fallback_encoding) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4eee9122a3bb8823 — Environment-variable access.

pkgs/python/[email protected]/setuptools/warnings.py:109

    enforce = os.getenv("SETUPTOOLS_ENFORCE_DEPRECATION", "false").lower()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fa0e74ac3a554b6e — Filesystem access.

pkgs/python/[email protected]/setuptools/wheel.py:261

                    with open(mod_init, 'w', encoding="utf-8") as fp:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #17c1278580152a7d — Environment-variable access.

pkgs/python/[email protected]/tools/build_launchers.py:102

        os.environ['ProgramFiles(x86)'],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #fe8e7f2f6c4cdb32 — Filesystem access.

pkgs/python/[email protected]/tools/finalize.py:39

    changelog = changelog_fn.read_text(encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #9146864e5cf9c520 — Filesystem access.

pkgs/python/[email protected]/tools/finalize.py:41

    changelog_fn.write_text(fixed, encoding='utf-8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

starlette

python dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #a3035e9d6fc29f95 — Environment-variable access.

pkgs/python/[email protected]/starlette/config.py:19

    def __init__(self, environ: MutableMapping[str, str] = os.environ):

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #853b2663cbd97973 — Filesystem access.

pkgs/python/[email protected]/starlette/config.py:113

        with open(file_name, encoding=encoding) as input_file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

tiktoken

python dependency

expand_more 16 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #67e2f8b8b1a483a7 — Environment-variable access.

pkgs/python/[email protected]/scripts/benchmark.py:16

    num_threads = int(os.environ["RAYON_NUM_THREADS"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #daecaf64d1a5a3ef — Filesystem access.

pkgs/python/[email protected]/scripts/redact.py:11

    text = path.read_text()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #8d112356e5f41957 — Filesystem access.

pkgs/python/[email protected]/scripts/redact.py:35

            path.write_text(redacted_text)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #c63f9164ed91fb6e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/wheel_download.py:13

    response = requests.get(artifacts_url, headers=headers)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling Excluded from app score unreachable #3b84fce0e474cf1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/scripts/wheel_download.py:31

        response = requests.get(download_url, headers=headers, stream=True)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #955fff057ed81ea1 — Filesystem access.

pkgs/python/[email protected]/scripts/wheel_download.py:35

        with open(temp_zip, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #698f854ace597614 — Filesystem access.

pkgs/python/[email protected]/tiktoken/_educational.py:212

    with open(__file__) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #093d317b749cbebc — Filesystem access.

pkgs/python/[email protected]/tiktoken/load.py:10

        with open(blobpath, "rb", buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #279f07243ca52fd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/tiktoken/load.py:17

        resp = requests.get(blobpath)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #82f27ccc09e41aef — Filesystem access.

pkgs/python/[email protected]/tiktoken/load.py:27

    return blobfile.read_bytes(blobpath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3874150bb816ed3d — Environment-variable access.

pkgs/python/[email protected]/tiktoken/load.py:37

    if "TIKTOKEN_CACHE_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3219ffe94bbf5499 — Environment-variable access.

pkgs/python/[email protected]/tiktoken/load.py:38

        cache_dir = os.environ["TIKTOKEN_CACHE_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4b374a0421441899 — Environment-variable access.

pkgs/python/[email protected]/tiktoken/load.py:39

    elif "DATA_GYM_CACHE_DIR" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #811e88bec8917cf0 — Environment-variable access.

pkgs/python/[email protected]/tiktoken/load.py:40

        cache_dir = os.environ["DATA_GYM_CACHE_DIR"]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57307207d811d633 — Filesystem access.

pkgs/python/[email protected]/tiktoken/load.py:55

        with open(cache_path, "rb", buffering=0) as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4818d328f79c034e — Filesystem access.

pkgs/python/[email protected]/tiktoken/load.py:78

        with open(tmp_filename, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

uvicorn

python dependency

expand_more 5 low-confidence finding(s)

low env_fs dependency Excluded from app score #4f9bc4df0f6ac8bd — Environment-variable access.

pkgs/python/[email protected]/uvicorn/config.py:351

        if workers is None and "WEB_CONCURRENCY" in os.environ:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6dcf19003cab63fa — Environment-variable access.

pkgs/python/[email protected]/uvicorn/config.py:352

            self.workers = int(os.environ["WEB_CONCURRENCY"])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c6cc67edbf808563 — Environment-variable access.

pkgs/python/[email protected]/uvicorn/config.py:356

            self.forwarded_allow_ips = os.environ.get("FORWARDED_ALLOW_IPS", "127.0.0.1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4da318aad4ca63c — Filesystem access.

pkgs/python/[email protected]/uvicorn/config.py:393

                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd827d727840a11d — Filesystem access.

pkgs/python/[email protected]/uvicorn/config.py:404

                with open(self.log_config) as file:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

voyageai

python dependency

expand_more 10 low-confidence finding(s)

low env_fs dependency Excluded from app score #0f9080988c81e15f — Filesystem access.

pkgs/python/[email protected]/voyageai/_base.py:34

        with open(config_path, "r") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #117ff276c9062dbd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.

pkgs/python/[email protected]/voyageai/api_resources/api_requestor.py:300

            result = _thread_context.session.request(
                method,
                abs_url,
                headers=headers,
                data=data,
                files=files,
                stream=stream,
                timeout=request_timeout if request_timeout else TIMEOUT_SECS,
                proxies=_thread_context.session.proxies,
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #5ff1d928c1e71fe2 — Environment-variable access.

pkgs/python/[email protected]/voyageai/util.py:13

VOYAGE_LOG = os.environ.get("VOYAGE_LOG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5c8d8694d5798faa — Environment-variable access.

pkgs/python/[email protected]/voyageai/util.py:79

    api_key_path = voyageai.api_key_path or os.environ.get("VOYAGE_API_KEY_PATH")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #771ac5f1ea2597a6 — Environment-variable access.

pkgs/python/[email protected]/voyageai/util.py:80

    api_key = voyageai.api_key or os.environ.get("VOYAGE_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d518184b140cce6d — Filesystem access.

pkgs/python/[email protected]/voyageai/util.py:84

        with open(api_key_path, "rt") as k:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a4bd5004c25c844 — Filesystem access.

pkgs/python/[email protected]/voyageai/video_utils.py:76

        with open(path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #74404b5f09bb0c9f — Filesystem access.

pkgs/python/[email protected]/voyageai/video_utils.py:164

        with open(path, "wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4de96628a4d2ce7c — Filesystem access.

pkgs/python/[email protected]/voyageai/video_utils.py:176

        with open(video, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c94d61fd975cd238 — Filesystem access.

pkgs/python/[email protected]/voyageai/video_utils.py:604

        with open(out_path, "rb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

xlsxwriter

python dependency

expand_more 18 low-confidence finding(s)

low env_fs tooling Excluded from app score unreachable #61fb32a288bde0f4 — Filesystem access.

pkgs/python/[email protected]/examples/autofilter.py:30

textfile = open("autofilter_data.txt", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress tooling Excluded from app score unreachable #f58bd7ab73b199cc — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/python/[email protected]/examples/images_bytesio.py:27

image_data = BytesIO(urlopen(url).read())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs tooling Excluded from app score unreachable #21f7db180c1f4ce5 — Filesystem access.

pkgs/python/[email protected]/examples/images_bytesio.py:38

image_file = open(filename, "rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #e6daa2ed038ba998 — Filesystem access.

pkgs/python/[email protected]/examples/unicode_polish_utf8.py:16

with open("unicode_polish_utf8.txt", mode="r", encoding="utf-8") as textfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #629ef6e1d5ba4904 — Filesystem access.

pkgs/python/[email protected]/examples/unicode_shift_jis.py:16

with open("unicode_shift_jis.txt", mode="r", encoding="shift_jis") as textfile:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unreachable #2ad5edc31f62aaf2 — Filesystem access.

pkgs/python/[email protected]/examples/vba_extract.py:22

    file = open(filename, "wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fdbf895d6c3fce6e — Filesystem access.

pkgs/python/[email protected]/setup.py:20

    long_description=open("README.rst", encoding="utf-8").read(),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8543a22e727269c2 — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/image.py:181

            with open(self.filename, "rb") as fh:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c257a2475995eeb — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/packager.py:780

                    os_file = open(os_filename, mode="wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1fd5d1fba17883f3 — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/packager.py:799

                    image_file = open(image.filename, mode="rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d518312a1763d774 — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/packager.py:825

                os_file = open(os_filename, mode="wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2db0c6646c54aa3c — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/packager.py:837

                vba_file = open(vba_project_signature, mode="rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46e2ee06978b6697 — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/packager.py:861

                os_file = open(os_filename, mode="wb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #98c9fcf2bffafaee — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/packager.py:873

                vba_file = open(vba_project, mode="rb")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7e7b0c038c5fae68 — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/theme.py:55

            self.fh = open(filename, mode="w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d9201008cfe90694 — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/worksheet.py:4868

            self.row_data_fh = open(filename, mode="w+", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6e2ba4c460c3a74c — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/worksheet.py:6076

            self.row_data_fh = open(filename, mode="a+", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0399173edfbd4c62 — Filesystem access.

pkgs/python/[email protected]/xlsxwriter/xmlwriter.py:47

            self.fh = open(filename, "w", encoding="utf-8")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

zhipuai

python dependency

expand_more 10 low-confidence finding(s)

low env_fs dependency Excluded from app score #5ebc21fde0c98c11 — Environment-variable access.

pkgs/python/[email protected]/zhipuai/_client.py:37

            api_key = os.environ.get("ZHIPUAI_API_KEY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cac9d1649505339f — Environment-variable access.

pkgs/python/[email protected]/zhipuai/_client.py:45

            base_url = os.environ.get("ZHIPUAI_BASE_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #410ed638a91aec5c — Environment-variable access.

pkgs/python/[email protected]/zhipuai/core/_base_models.py:57

            extra="allow", defer_build=coerce_boolean(os.environ.get("DEFER_PYDANTIC_BUILD", "true"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aa2dfe6db956456a — Filesystem access.

pkgs/python/[email protected]/zhipuai/core/_files.py:66

            return (path.name, path.read_bytes())

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a49d07b3baeb980 — Filesystem access.

pkgs/python/[email protected]/zhipuai/core/_files.py:78

        return pathlib.Path(file).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #46224103e9094d72 — Filesystem access.

pkgs/python/[email protected]/zhipuai/core/_legacy_binary_response.py:147

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77a390a469dabd44 — Filesystem access.

pkgs/python/[email protected]/zhipuai/core/_legacy_binary_response.py:157

        with open(file, mode="wb") as f:

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #033c67cd4eec2f49 — Filesystem access.

pkgs/python/[email protected]/zhipuai/core/_utils/_transform.py:216

            binary = data.read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0c4efd740924019b — Filesystem access.

pkgs/python/[email protected]/zhipuai/core/_utils/_transform.py:354

            binary = await anyio.Path(data).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #892da7b050ec62a0 — Filesystem access.

pkgs/python/[email protected]/zhipuai/core/_utils/_utils.py:370

    contents = Path(path).read_bytes()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

@sigma/edge-curve prod — dist-only: no readable source
@sigma/node-border prod — dist-only: no readable source
react-select prod — dist-only: no readable source
spacy prod — no sdist (wheels only)
faiss-cpu prod — no sdist (wheels only)
pymilvus prod — no sdist (wheels only)
llama-index prod — no python source in sdist
ragas prod — sdist exceeds byte cap

verified_user Possible application data leak

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz Potential data exfiltration in application code

</> First-Party Code

first-party (python)

</> Dependencies

langfuse

lightrag-hku

redis

PyJWT

PyYAML

aioboto3

aiohttp

anthropic

ascii_colors

asyncpg

cairosvg

configparser

cryptography

datasets

defusedxml

distro

fastapi

google-api-core

google-genai

gunicorn

httpx

httpx2

jiter

katex

langchain-experimental

langchain-text-splitters

llama-index-llms-openai

nano-vectordb

neo4j

networkx

numpy

ollama

openai

openpyxl

opensearch-py

packaging

pandas

pipmaster

pre-commit

psutil

pycryptodome

pydantic

pymongo

pypdf

pypinyin

pytest

python-docx

python-dotenv

python-multipart

python-pptx

pytz

qdrant-client

ruff

setuptools

starlette

tiktoken

uvicorn

voyageai

xlsxwriter

zhipuai

Skipped dependencies