Close Open Privacy Scan

link https://github.com/mckaywrigley/chatbot-ui

bolt Snapshot: commit 81328b6

science engine v1.5

schedule 2026-07-15T02:11:47.755767+00:00

smart_toy AI deps detected: @anthropic-ai/sdk, @google/generative-ai, @mistralai/mistralai, ai +2 more — detected in dependencies, not a safety judgment.

App Privacy Score

32 /100

High privacy risk — application leak confirmed

High risk · 525 finding(s)

Dependency score: 22 (High risk)

bar_chart Score Breakdown

pii_flow −60

egress −5

env_fs −3

list Scan Summary

4 high 61 medium 460 low

First-party packages: 1

Dependency packages: 26

Ecosystem: npm

swap_horiz Confirmed data exfiltration in application code

External domains: 169.254.169.254aaa.nonexistanturl.comai-sdk.devai.google.devanimations.devapi.anthropic.comapi.groq.comapi.mistral.aiapi.openai.comapi.perplexity.aiauth.openai.combedrock-mantlebitcoin.orgbrowser-http-intake.logs.datadoghq.eucdn.jsdelivr.netchevrotain.iocookbook.openai.comdate-fns.orgdeveloper.mozilla.orgdevelopers.openai.comdocs.anthropic.comdocs.expo.devdocs.mistral.aidocs.perplexity.aiedge-config.vercel.comen.wikipedia.orgesm.rungenerativelanguage.googleapis.comgist.github.comgithub.comgoo.glgroq.comhelp.openai.comhuggingface.cojson-schema.orgmanagement.azure.commetadata.google.internalmy.staging.websitemysite.comnextjs.orgnpm.imollama.aiopenrouter.aiopenrouter.devplatform.claude.complatform.openai.compurl.oclc.orgreact.devreactjs.orgregistry.yarnpkg.comschemas.microsoft.comschemas.openxmlformats.orgschemas.zwobble.orgsonner.emilkowal.skistuk.github.iosupabase.comtwitter.comunixunpkg.comvercel.comwww.chatbotui.comwww.w3.orgyarnpkg.comyour-endpoint.openai.azure.comyourfile.here

high first-party (npm) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

repo/components/utility/drawing-canvas.tsx:12 → repo/components/utility/drawing-canvas.tsx:73

high first-party (npm) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

repo/components/utility/global-state.tsx:159 → repo/components/utility/global-state.tsx:180

high first-party (npm) User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

repo/lib/models/fetch-models.ts:58 → repo/lib/models/fetch-models.ts:57

hub Dependency data flows (62)

high ai dependency User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 → pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26 → pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:58

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:65

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:134

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:138

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:151

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:192 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:216

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:225 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:251

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:284

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:291

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → pkgs/npm/@[email protected]__reposrc/samples/chat.js:45

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → pkgs/npm/@[email protected]__reposrc/samples/chat.js:47

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24 → pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44 → pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74 → pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27 → pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64 → pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/embed.js:24 → pkgs/npm/@[email protected]__reposrc/samples/embed.js:31

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/embed.js:39 → pkgs/npm/@[email protected]__reposrc/samples/embed.js:56

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → pkgs/npm/@[email protected]__reposrc/samples/files.js:41

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → pkgs/npm/@[email protected]__reposrc/samples/files.js:69

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → pkgs/npm/@[email protected]__reposrc/samples/files.js:102

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → pkgs/npm/@[email protected]__reposrc/samples/files.js:117

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → pkgs/npm/@[email protected]__reposrc/samples/files.js:133

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → pkgs/npm/@[email protected]__reposrc/samples/files.js:161

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → pkgs/npm/@[email protected]__reposrc/samples/files.js:194

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → pkgs/npm/@[email protected]__reposrc/samples/files.js:209

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:222 → pkgs/npm/@[email protected]__reposrc/samples/files.js:239

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:220 → pkgs/npm/@[email protected]__reposrc/samples/files.js:267

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:275 → pkgs/npm/@[email protected]__reposrc/samples/files.js:281

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:290 → pkgs/npm/@[email protected]__reposrc/samples/files.js:304

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:314 → pkgs/npm/@[email protected]__reposrc/samples/files.js:327

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61 → pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24 → pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24 → pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28 → pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59 → pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31 → pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61 → pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24 → pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214

medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255

</> First-Party Code

first-party (npm)

npm first-party

high pii_flow production #9014618b8eb37a7a — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

repo/components/utility/drawing-canvas.tsx:73 · flow /tmp/closeopen-wtwrk6jz/repo/components/utility/drawing-canvas.tsx:12 → /tmp/closeopen-wtwrk6jz/repo/components/utility/drawing-canvas.tsx:73

      fetch(dataURL)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

high pii_flow production #07126bc471f2807d — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

repo/components/utility/global-state.tsx:180 · flow /tmp/closeopen-wtwrk6jz/repo/components/utility/global-state.tsx:159 → /tmp/closeopen-wtwrk6jz/repo/components/utility/global-state.tsx:180

          const response = await fetch(workspaceImageUrl)

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

high pii_flow production #6b0869f87173e3df — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

repo/lib/models/fetch-models.ts:57 · flow /tmp/closeopen-wtwrk6jz/repo/lib/models/fetch-models.ts:58 → /tmp/closeopen-wtwrk6jz/repo/lib/models/fetch-models.ts:57

    const response = await fetch(
      process.env.NEXT_PUBLIC_OLLAMA_URL + "/api/tags"
    )

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

expand_more 41 low-confidence finding(s)

low env_fs test-only #a0cd14675131907c — Environment-variable access.

repo/__tests__/playwright-test/playwright.config.ts:17

  forbidOnly: !!process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only #4345adecc3ab5112 — Environment-variable access.

repo/__tests__/playwright-test/playwright.config.ts:19

  retries: process.env.CI ? 2 : 0,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs test-only #3bbbc63c8209a09d — Environment-variable access.

repo/__tests__/playwright-test/playwright.config.ts:21

  workers: process.env.CI ? 1 : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #8c3c1a39af307192 — Environment-variable access.

repo/app/[locale]/layout.tsx:75

    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #3588a50564a5d593 — Environment-variable access.

repo/app/[locale]/layout.tsx:76

    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4b54bc4028469abf — Environment-variable access.

repo/app/[locale]/login/page.tsx:24

    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #342022f3cbfd58a2 — Environment-variable access.

repo/app/[locale]/login/page.tsx:25

    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ea27ea585b5e1599 — Environment-variable access.

repo/app/[locale]/login/page.tsx:86

    if (process.env.EDGE_CONFIG) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #18aebd6e744feccd — Environment-variable access.

repo/app/[locale]/login/page.tsx:90

    return process.env[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2f3134f95ec27a7b — Environment-variable access.

repo/app/api/chat/custom/route.ts:21

      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #f549eeb51dd94d0d — Environment-variable access.

repo/app/api/chat/custom/route.ts:22

      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #df9c79c1981c2335 — Environment-variable access.

repo/app/api/retrieval/process/docx/route.ts:21

      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #9947c110586ad9bb — Environment-variable access.

repo/app/api/retrieval/process/docx/route.ts:22

      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #53efbbf8d2e3fdba — Environment-variable access.

repo/app/api/retrieval/process/route.ts:19

      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #720a6a1a1f5f1a0b — Environment-variable access.

repo/app/api/retrieval/process/route.ts:20

      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #57295f6e9146db67 — Environment-variable access.

repo/app/api/retrieval/retrieve/route.ts:20

      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b212ac6448884bf6 — Environment-variable access.

repo/app/api/retrieval/retrieve/route.ts:21

      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #4f0d967fc20c4bc9 — Environment-variable access.

repo/app/api/username/available/route.ts:14

      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #431f04b7af5e25e3 — Environment-variable access.

repo/app/api/username/available/route.ts:15

      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #1288407c3179055a — Environment-variable access.

repo/app/api/username/get/route.ts:14

      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #84ed32815ec24dbf — Environment-variable access.

repo/app/api/username/get/route.ts:15

      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #36ae62bc8f9ec74a — Environment-variable access.

repo/components/chat/chat-helpers/index.ts:163

    process.env.NEXT_PUBLIC_OLLAMA_URL + "/api/chat",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2abd52433f5f7f9a — Environment-variable access.

repo/components/utility/global-state.tsx:147

      if (process.env.NEXT_PUBLIC_OLLAMA_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cab2201936daa530 — Environment-variable access.

repo/components/utility/profile-settings.tsx:618

                              !!process.env.NEXT_PUBLIC_OPENAI_ORGANIZATION_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #69df9ea3e05d692c — Environment-variable access.

repo/db/storage/files.ts:13

    process.env.NEXT_PUBLIC_USER_FILE_SIZE_LIMIT || "10000000"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #2d888df5b15ddfc1 — Environment-variable access.

repo/lib/envs.ts:5

  return Boolean(process.env[type])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #b4eb3e256a3bcf9b — Environment-variable access.

repo/lib/models/fetch-models.ts:58

      process.env.NEXT_PUBLIC_OLLAMA_URL + "/api/tags"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress production #a4e7321ea1c2fef9 — Hardcoded external endpoint. Review what data is sent to this destination.

repo/lib/models/fetch-models.ts:84

    const response = await fetch("https://openrouter.ai/api/v1/models")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs production #50382fe85cf298f0 — Environment-variable access.

repo/lib/server/server-chat-helpers.ts:9

    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #ba3b5204525950fe — Environment-variable access.

repo/lib/server/server-chat-helpers.ts:10

    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #265b6416b7ee4f70 — Environment-variable access.

repo/lib/server/server-chat-helpers.ts:61

    if (process.env[envKey]) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #40fd359230e3fe3f — Environment-variable access.

repo/lib/server/server-chat-helpers.ts:62

      ;(profile as any)[profileKey] = process.env[envKey]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #baac0f535e6d0c73 — Environment-variable access.

repo/lib/supabase/browser-client.ts:5

  process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #29b11121a91c316e — Environment-variable access.

repo/lib/supabase/browser-client.ts:6

  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #734a67881c0f74de — Environment-variable access.

repo/lib/supabase/client.ts:5

    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #463d61686a0db0dc — Environment-variable access.

repo/lib/supabase/client.ts:6

    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #cd3d3e8abb509271 — Environment-variable access.

repo/lib/supabase/middleware.ts:13

    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #d2e431ec186aab63 — Environment-variable access.

repo/lib/supabase/middleware.ts:14

    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #df91d9f7465fe0ab — Environment-variable access.

repo/lib/supabase/server.ts:6

    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #862f96260b59a298 — Environment-variable access.

repo/lib/supabase/server.ts:7

    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs production #298bd836b30694b5 — Environment-variable access.

repo/next.config.js:2

  enabled: process.env.ANALYZE === "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

ai

npm dependency

high pii_flow dependency Excluded from app score #4c0a92181deb077c — User/PII-bearing data read from the environment or filesystem flows to an external network call. This is potential data exfiltration.

pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 → /tmp/closeopen-wtwrk6jz/pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110

      const response = await fetch(this.api.token, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ sessionConfig: this.sessionConfig }),
      });

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.

@google/generative-ai

npm dependency

medium pii_flow dependency Excluded from app score #645197abe5c855cd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #10be3cd6e5186b50 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:58 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:58

  console.log(cacheResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #db32a8404250779b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:65 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:65

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #09aec198a7235c7d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:134 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:134

  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #d45ed24b70b959f6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:138 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:138

  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #94927cd3953196f4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:151 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:151

  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #1a3dfbb9aa17738f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:216 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:192 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:216

  console.log(cacheGetResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e4d75a7ba8768b6f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:251 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:225 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:251

    console.log(item);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #bba8a20d885fd62a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:284 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:284

  console.log("initial cache data:", cacheResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #69802cb1b3ea58d3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:291 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/cache.js:291

  console.log("updated cache data:", cacheUpdateResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #fa3e6ed57c9a9086 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:45 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/chat.js:45

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e82abc394e9b909c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:47 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/chat.js:47

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #fa99a5f19d07b0f3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #839bcbd9cb0897be — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cf648daa15abb8c7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #29a2ec68a17f53b8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f614ac3401b4b31a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #75a391379842453b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45

  console.log(countResult.totalTokens); // 11

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c89231e81eaf7239 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55

  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2f9762cd4c46b141 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86

  console.log(countResult.totalTokens); // 10

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e39c9b08c45b2322 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96

  console.log(chatResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #1ac3dd93852e38b7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132

  console.log(countResult.totalTokens); // 265

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8ddbb2c16a4beb43 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140

  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #cd0ee62c0f62d834 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178

  console.log(countResult.totalTokens); // 265

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4455722cf8c88b35 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186

  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #93fbcf9a709bbb4f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242

  console.log(countResult.totalTokens); // 302

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8ec59e2fbb1c6c8f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250

  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0b87d8ab17eb0487 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302

  console.log(result.totalTokens); // 10

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #82999f571f62b5d6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311

  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #635379d469af0b84 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335

  console.log(resultNoInstructions);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e3d6e9f9732ebe87 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349

  console.log(resultWithInstructions);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e2afdfcd128f2dc8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368

  console.log(resultNoTools);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #3acc7264096ee174 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388

  console.log(resultWithTools);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #6ab809e45d6d25cd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/embed.js:31 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/embed.js:24 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/embed.js:31

  console.log(result.embedding);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #90de1e04af51ba56 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/embed.js:56 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/embed.js:39 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/embed.js:56

  console.log(result.embeddings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #0875a731c4c6264d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:41 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:41

  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8a1cac020955a872 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:69 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:69

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #76e09443e5f6a5ad — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:102 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:102

  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #a1bb9a807406cc13 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:117 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:117

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4c291d462c14d2dd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:133 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:133

  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4028c78e475d407c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:161 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:161

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #153b90bbf6ef0262 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:194 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:194

  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #9e64b2bc7d5a4dad — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:209 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:209

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b0d98d087e8dcc7f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:239 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:222 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:239

  console.log(
    `Uploaded file ${uploadResponse.file.displayName} as: ${uploadResponse.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #781da894d0269993 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:267 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:220 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:267

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #f32776e117950b96 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:281 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:275 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:281

    console.log(`name: ${file.name} | display name: ${file.displayName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #e9686b541e7a6988 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:304 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:290 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:304

  console.log(
    `Retrieved file ${getResponse.displayName} as ${getResponse.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #be844b5770960ea9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/files.js:327 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:314 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/files.js:327

  console.log(`Deleted ${uploadResult.file.displayName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #8b27de9676606330 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93

    console.log(result2.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #c6c3c771c4047709 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37

    console.log(result.response.candidates[0].logprobsResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #27116b38ceb148b0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #b44c7d79ccd6d7d4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50

    console.log(result.response.candidates[0].safetyRatings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #bc7d469ecb8f5e73 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85

    console.log(result.response.candidates[0].safetyRatings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #331b2213057c6f45 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50

  console.log(result.response.candidates[0].groundingMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #4023765c2a95a759 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75

  console.log(result.response.candidates[0].groundingMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #074c92b8742238de — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35

  console.log(text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #78b49dd1dcadf4fd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #2df023521cac2a23 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #fe44a3354c89f03d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #5786d918a1859077 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

medium pii_flow dependency Excluded from app score #930a8f75e6679958 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255 · flow /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223 → /tmp/closeopen-wtwrk6jz/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255

  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.

expand_more 156 low-confidence finding(s)

low env_fs dependency Excluded from app score #87fed550643b7b78 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/rollup.config.mjs:32

const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #58405e2e9203a132 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3b973a2dc5ed5a70 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:34

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52cbd3c5d8593028 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:35

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00f7710f3797a198 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:60

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b47407b7fa5adff4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:75

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #86ddffd79af81e45 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:76

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c9463ca8cd0ff355 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:102

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e9cdb9da6c894a9f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:114

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d2d99571cf53c58 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:115

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f2d9ced143a6afd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:116

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d116c7ac31950595 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:161

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #107fb04823e9b5a1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:162

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #650185c6bedcdb0d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:192

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #75976be4fab359f2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:193

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e34b5fd174ac735 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:225

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d198fcd1e64ac9b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:226

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #22cc25efd56f6e68 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:261

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cc980603e656a786 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/cache.js:262

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #53bf273f2e4cbb95 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:19

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4924337beb8f7e51 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:30

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd3f09ce2c67bda8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:55

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88687a4d9ce3a6e4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:86

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2a4eafeb91e92ddb — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/chat.js:98

      data: Buffer.from(fs.readFileSync(`${mediaPath}/jetpack.jpg`)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac87938547630105 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a7b0c42728142af5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9ec6c775ea94472 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #108bf75dfcae7306 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe6e01ddeb980aae — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a2be0f932db746a7 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:24

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4a03bbaa7bc1a202 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbe46547ee436744 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a57866f92e832af7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2eead210be119d2 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:114

        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d12a87058fe762b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5a86b2730b2b0231 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:165

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #186537d3a4983042 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #39741d71f832cdc9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:228

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #61672b43b93bdc84 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c624f91e5318fac1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:270

  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #99c415f209d8cbf3 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:293

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cff53e51227bcba4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #08b6da0f05a82747 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ed74df89e393076 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/embed.js:24

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e9136a9f905237e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/embed.js:39

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #feb8cc3e9f3eb8f5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:31

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bd018f304bac091f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:58

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f45e8dbe3420762 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:78

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2816cf63c01032f0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:106

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #649334f2c005a294 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:126

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c965ce9decbe9d75 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:150

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1bd1c89a779f0854 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:170

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62b0f0f9791a2a0d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:198

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #17586ef2c624b371 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:220

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f8efc8708952a017 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:222

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a06c538b46ddf18e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:275

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92a0463c9f908ca1 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:290

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #85f7a27bc44d9ef2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/files.js:314

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8e57446c4ab6b6fb — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b8dae0bf12bda1df — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24

    const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c3f584dde1e93ac5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2913f5638c482e4f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca9e4182958ce613 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #67bc82082afd01cd — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ca5c563617c16b5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bc605d717c20c76 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #243bcbbee5edb430 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:20

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #705cdcc3e2b5ae2e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2f073d9a23bd0ab3 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:45

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a97485aea496e643 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #77d432a1427a0c1d — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:70

        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c26159920bf9d656 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:92

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #670514f55e819515 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:98

        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1fb7617283ed0f6 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #814ab41da8f8f4e2 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:131

        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #edb5fa3a189b977e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:157

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2bb8e416eda113d9 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:163

        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a66c1f22be2ea60d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8445451dcb1c2426 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:200

        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd690c5dacf25d46 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5263d4213fef5fe3 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:226

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e77c89a762e1b77d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:265

  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d7a02805dc257366 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:268

  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c986ba817989a473 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/utils/check-samples.js:19

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eb62860516d33cd6 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/utils/check-samples.js:30

      const file = fs.readFileSync(join(samplesDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4c454ccc38d003e8 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:19

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #db0321a27e133034 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:27

  const typings = fs.readFileSync(filePath, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cce5a613680e8045 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:90

      const file = fs.readFileSync(join(samplesDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #06ee0791bbeb1539 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:134

      fs.writeFileSync(join(samplesDir, filename), newFileLines.join("\n"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0b76def7a31b8601 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:18

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ec8d9ffd39723252 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:28

const API_KEY = process.env.API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dc5e299ae6f25ed7 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:70

      const data = fs.readFileSync(sanitizedPath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #0a3bcc04fba678dd — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/license.ts:18

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #0562b8e1003c87ea — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/license.ts:22

const licenseHeader = fs.readFileSync(
  join(__dirname, "./license.txt"),
  "utf-8",
);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #898581bad67f1449 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/license.ts:33

  const fileContents = paths.map((path) => fs.readFileSync(path, "utf-8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4372f14910512289 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/scripts/license.ts:84

          return fs.writeFileSync(path, result, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2b14e77c47159951 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:26

import { readFile } from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #288cfdd6b3be480a — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:71

    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5f90a47be6868c71 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:112

    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #428f498389e36937 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:147

    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51f7c3714362b163 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:194

    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2986cbb11e1bc399 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/server/file-manager.ts:19

import { readFileSync } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #641e308f388e5e5d — Filesystem access.

pkgs/npm/@[email protected]__reposrc/src/server/file-manager.ts:57

    const file = fileData instanceof Buffer ? fileData : readFileSync(fileData);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bdce9f60d6efcbe2 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:42

      process.env.GEMINI_API_KEY,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5649b0f1981c9d12 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:57

    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cae1bc04e3662e6b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:66

    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f6c42e4f60e1a987 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:77

    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #099044a692e6ba8b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:84

    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81a1bdc196f4c87e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:96

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0623cef746eb8555 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:114

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #775d70bab96ff41b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:127

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4720849beccab6c0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:140

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88b4b660dbcdad14 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:150

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #778f26fbc719d18d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:160

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7f417b3056e5dbce — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:186

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5ef40893c55dd6eb — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:203

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #52b45b66c7cbae36 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:215

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #62814fbdfe8ffabb — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:227

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #01fad2f393abe0da — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:239

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1fe306f1c7e048f — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:40

      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6273be37541ee8af — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:68

      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #accc3c57ac868676 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:99

      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #51e2f9a348cc9af9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:130

      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3a709952624df61b — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:180

      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #54e40fb9e7faed9d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:220

      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #00b976bcaea57066 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:240

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4ba59a1626a592c5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:33

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3d477d0dbcd28c86 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:51

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f1587fbf86deec45 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:70

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #014b33187f9b71ed — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/embed-content.test.ts:32

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42cfc8ad935e2ad0 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:18

import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #10b2e150144523a0 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:35

    const imageBuffer = fs.readFileSync(
      join(__dirname, "../../test-utils/cat.png"),
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7b4d7e0521c21557 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:38

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #95ea5d913e60ffd0 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-search-grounding.test.ts:37

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #daf634427ae736ea — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-tools.test.ts:35

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #129ab681cead8db9 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-tools.test.ts:179

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d024044280945caf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:39

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3fbff61a62f4d994 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:66

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1cfa5e0364d8d80d — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:88

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c56dae8ec34d7e62 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:103

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80153590f2a5e235 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat-tools.test.ts:76

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #81d5aab75ae86f2e — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:32

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3f313981923c141 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:55

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a1ee6c9f65426a55 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:91

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8fc195b1b13569e5 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:28

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8104672dc4745faf — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:43

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3dc9858399db1ca7 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:66

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #abc0ffefe0155408 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:89

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5b3758c8250abaca — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:125

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cf4a70adcfd13ca8 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:173

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6bccfd1f564b731c — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:196

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1828c2a73ed09da4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:211

    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92df1a33b73575be — Filesystem access.

pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:18

import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #540a68b3e4b3e17d — Filesystem access.

pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:68

  const fullText = fs.readFileSync(join(mockResponseDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #642ad9c40b1e8c40 — Filesystem access.

pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:76

  const fullText = fs.readFileSync(join(mockResponseDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #63f6b8b3af479ca4 — Environment-variable access.

pkgs/npm/@[email protected]__reposrc/web-test-runner.config.mjs:17

        <script>window.process = { env: { GEMINI_API_KEY: "${process.env.GEMINI_API_KEY}" } }</script>

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@anthropic-ai/sdk

npm dependency

expand_more 44 low-confidence finding(s)

low env_fs dependency Excluded from app score #0de33baaad5dfd7c — Filesystem access.

pkgs/npm/@[email protected]/core/credentials.js:110

        configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #4e9426592d842ef9 — Filesystem access.

pkgs/npm/@[email protected]/core/credentials.js:210

        raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e3d50f702dc64c4c — Filesystem access.

pkgs/npm/@[email protected]/core/credentials.js:308

        return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f90881a82dc4a5e — Filesystem access.

pkgs/npm/@[email protected]/core/credentials.mjs:73

        configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #60f9d5ec0fedef28 — Filesystem access.

pkgs/npm/@[email protected]/core/credentials.mjs:172

        raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c76bf7b9a3ffd1e8 — Filesystem access.

pkgs/npm/@[email protected]/core/credentials.mjs:268

        return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #88609023d391d4c0 — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/credential-chain.js:203

            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d889c980736473b2 — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/credential-chain.mjs:166

            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #30e00c023a392237 — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/identity-token.js:51

            content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ae0da4aec3e94ab6 — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/identity-token.mjs:14

            content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #80b9b66bc673db0d — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/types.js:195

            await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d898e4191e178aa4 — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/types.mjs:154

            await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c4a9ec1eaf1ebb14 — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:56

            raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #011621c1c8ef9d5e — Filesystem access.

pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:20

            raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9e857979acdc7cbb — Filesystem access.

pkgs/npm/@[email protected]/src/core/credentials.ts:154

    configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8ae847fdb0d2d910 — Filesystem access.

pkgs/npm/@[email protected]/src/core/credentials.ts:258

    raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #56e66fd66d729920 — Filesystem access.

pkgs/npm/@[email protected]/src/core/credentials.ts:372

    return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #813b88ce54c198b9 — Filesystem access.

pkgs/npm/@[email protected]/src/lib/credentials/credential-chain.ts:250

      const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #357fa6b217c5d883 — Filesystem access.

pkgs/npm/@[email protected]/src/lib/credentials/identity-token.ts:17

      content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #8f1172d4ffbc471f — Filesystem access.

pkgs/npm/@[email protected]/src/lib/credentials/types.ts:222

      await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40e1651796f00528 — Filesystem access.

pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:45

      raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #35cb5ba6e83ac83c — Filesystem access.

pkgs/npm/@[email protected]/src/tools/agent-toolset/fs-util.ts:112

    await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5747af6d0df9950c — Filesystem access.

pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:457

        data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9985d148f61a0c93 — Filesystem access.

pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:533

        data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #32eaa479dfc01a8b — Environment-variable access.

pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:806

  const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1908ecd6dbd735cd — Filesystem access.

pkgs/npm/@[email protected]/src/tools/memory/node.ts:4

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #b36af74f695dce11 — Filesystem access.

pkgs/npm/@[email protected]/src/tools/memory/node.ts:52

    await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #eccd24d4dad5bfc2 — Filesystem access.

pkgs/npm/@[email protected]/src/tools/memory/node.ts:101

    return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a7fa7d1aada664e9 — Filesystem access.

pkgs/npm/@[email protected]/src/tools/memory/node.ts:256

      await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #feaafee29e830846 — Filesystem access.

pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.js:115

        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #54dcb89d2804bad9 — Filesystem access.

pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.mjs:107

        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1ba126d25ca673dd — Filesystem access.

pkgs/npm/@[email protected]/tools/agent-toolset/node.js:390

                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #e747f42273bee473 — Filesystem access.

pkgs/npm/@[email protected]/tools/agent-toolset/node.js:469

                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5a866a80a4fc8172 — Environment-variable access.

pkgs/npm/@[email protected]/tools/agent-toolset/node.js:755

    const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #aeb77488f83e3665 — Filesystem access.

pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:375

                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #b6da5c07b7d5e2ff — Filesystem access.

pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:454

                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #b7710ab5d14e9afb — Environment-variable access.

pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:740

    const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4cfc2e9f6387dd1d — Filesystem access.

pkgs/npm/@[email protected]/tools/memory/node.js:43

        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #17a7131ec212f260 — Filesystem access.

pkgs/npm/@[email protected]/tools/memory/node.js:91

        return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #d54d0670e0601aaa — Filesystem access.

pkgs/npm/@[email protected]/tools/memory/node.js:213

            await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a2d10092863fef7a — Filesystem access.

pkgs/npm/@[email protected]/tools/memory/node.mjs:2

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #6e4b3ffcc88a3c35 — Filesystem access.

pkgs/npm/@[email protected]/tools/memory/node.mjs:38

        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #bb9c7508b609cc76 — Filesystem access.

pkgs/npm/@[email protected]/tools/memory/node.mjs:86

        return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #495dbe9fe3f1c796 — Filesystem access.

pkgs/npm/@[email protected]/tools/memory/node.mjs:208

            await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@apidevtools/json-schema-ref-parser

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #bf2655c44641c820 — Filesystem access.

pkgs/npm/@[email protected]/lib/resolvers/file.ts:39

      return await fs.promises.readFile(path);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@hookform/resolvers

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #770120d0d1a84e1f — Environment-variable access.

pkgs/npm/@[email protected]/yup/src/yup.ts:97

      if (schemaOptions?.context && process.env.NODE_ENV === 'development') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@mistralai/mistralai

npm dependency

expand_more 41 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #b83158ca0af75435 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_audio_transcription_diarize.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #c0133bb840a85e54 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_audio_transcription_stream.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #67128ef40247572c — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1147e92c5be3f090 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #c181f25fe581753d — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #e21333649d6d6b23 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_chat_streaming.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1f757dc30785607e — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #41ef788f7ab2edb7 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_conversation_agent.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #57d7d0d7c0c97223 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #48f59eab0ee0fbeb — Filesystem access.

pkgs/npm/@[email protected]/examples/src/async_files.ts:1

import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #8fc7894b34b4774e — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_files.ts:6

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4226d8b541e05108 — Filesystem access.

pkgs/npm/@[email protected]/examples/src/async_files.ts:19

const blob = new Blob([fs.readFileSync(filePath)], {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #dd0d375debe3708c — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #3c82f3a33dbc2310 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #39d3f29945b1922d — Filesystem access.

pkgs/npm/@[email protected]/examples/src/async_jobs.ts:1

import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #246e0f5681f34cd8 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_jobs.ts:6

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #842c83d5c1eefa0c — Filesystem access.

pkgs/npm/@[email protected]/examples/src/async_jobs.ts:19

const blob = new Blob([fs.readFileSync(filePath)], {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #99d269dfe0867d8e — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_json_format.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #50b23526a2a02868 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_list_models.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #34e0f75ba87727a9 — Filesystem access.

pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:2

import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #b77099bfae4ed610 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:6

const apiKey = process.env.MISTRAL_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #dad1ecb4bec6a12f — Filesystem access.

pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:16

const uploaded_file = fs.readFileSync(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #32ebec80a9acd067 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:3

const apiKey = process.env.MISTRAL_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #f73b60083357afc4 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #d2bac9c94e826f09 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:3

const azureAPIKey = process.env["AZURE_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5d49edf5ae492514 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:8

const azureEndpoint = process.env["AZURE_ENDPOINT"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #6bc15f3ec183b8d5 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/error_handling.ts:4

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #f6aa018ddea4233d — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/gcp/async_chat_no_streaming.ts:3

const projectId = process.env["GOOGLE_PROJECT_ID"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #f0ab77245e05dad9 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #93541896eecbe0f0 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:38

      default: process.env["MISTRAL_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4c6010697b33a58c — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:43

      default: process.env["MISTRAL_BASE_URL"] ?? "wss://api.mistral.ai",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #641513a15a2d5566 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:107

  const apiKey = args.apiKey ?? process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a34cbde2a52a5ee5 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:46

      default: process.env["MISTRAL_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #932b1b9a09522fb5 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:51

      default: process.env["MISTRAL_BASE_URL"] ?? "https://api.mistral.ai",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4a72dd18238b11b4 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:162

  const apiKey = args.apiKey ?? process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a9e77369a2f4798d — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/reasoning.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #06288a6aa69ac748 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #284d582539d275f0 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1cf5d0019c99cdf7 — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/reasoning_with_streaming.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #ba68bb4e3cf9dcde — Environment-variable access.

pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3

const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #164d1b28e7f46cb2 — Environment-variable access.

pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:18

  apiKey: process.env["MISTRAL_API_KEY"] ?? "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@radix-ui/react-avatar

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #65b1a2fdc6c4c9ad — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/avatar.tsx:197

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f7c74f565555265c — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/avatar.tsx:215

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@radix-ui/react-context-menu

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #81fe91a73d7834b0 — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/context-menu.tsx:51

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@supabase/ssr

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #fcdbfe1b195e68b5 — Environment-variable access.

pkgs/npm/@[email protected]/src/warnDeprecatedPackage.ts:19

  const packageName = process.env.npm_package_name;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@vercel/edge-config

npm dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #71d717a9b0d8b594 — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:76

      if (typeof process !== 'undefined' && process.env.VERCEL_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #633378018af0dd5a — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:77

        headers['x-edge-config-vercel-env'] = process.env.VERCEL_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e5eff850a0532da8 — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:93

        process.env.NODE_ENV === 'development' &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #880cb71fb393f156 — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:94

        process.env.EDGE_CONFIG_DISABLE_DEVELOPMENT_SWR !== '1';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1a9d0a3d289e4c66 — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:59

    if (!process.env.AWS_LAMBDA_FUNCTION_NAME) return null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #13c059a366a11e5a — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:148

    if (typeof process !== 'undefined' && process.env.VERCEL_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fba1add03be63d6f — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:149

      headersRecord['x-edge-config-vercel-env'] = process.env.VERCEL_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #40d2317ae12020c7 — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/index.ts:54

    defaultEdgeConfigClient = createClient(process.env.EDGE_CONFIG);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b490e95e9bf64be4 — Environment-variable access.

pkgs/npm/@[email protected]__sourcemap/src/utils/tracing.ts:53

      process.env.EDGE_CONFIG_TRACE_VERBOSE === 'true' ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@xenova/transformers

npm dependency

expand_more 6 low-confidence finding(s)

low env_fs dependency Excluded from app score #b106c75d1f0adf98 — Filesystem access.

pkgs/npm/@[email protected]/src/env.js:25

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e11edbe34fdaee2f — Filesystem access.

pkgs/npm/@[email protected]/src/utils/hub.js:8

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f17abd22eb371823 — Filesystem access.

pkgs/npm/@[email protected]/src/utils/hub.js:109

        const data = await fs.promises.readFile(this.filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e515ca32ee50a477 — Filesystem access.

pkgs/npm/@[email protected]/src/utils/hub.js:120

        const data = await fs.promises.readFile(this.filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e1ce8ffd3fe7ceff — Filesystem access.

pkgs/npm/@[email protected]/src/utils/hub.js:131

        const data = await fs.promises.readFile(this.filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b1f6003e2381a64e — Filesystem access.

pkgs/npm/@[email protected]/src/utils/hub.js:280

            await fs.promises.writeFile(outputPath, buffer);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

class-variance-authority

npm dependency

expand_more 3 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #e4bc10fa5d1288e5 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:15

  branch: process.env.NEXT_PUBLIC_VERCEL_GIT_COMMIT_REF || "main",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #3da4b4ffb4b7164e — Environment-variable access.

pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:17

    process.env.NEXT_PUBLIC_VERCEL_GIT_REPO_OWNER || "joe-bell",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #14c4b818a5f5eb6a — Environment-variable access.

pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:18

    process.env.NEXT_PUBLIC_VERCEL_GIT_REPO_SLUG || "cva",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

d3-dsv

npm dependency

expand_more 12 low-confidence finding(s)

low env_fs dependency Excluded from app score #01f3613b531b032f — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2dsv.js:5

import {readFileSync} from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #472a4953bb04970c — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2dsv.js:17

    .version(JSON.parse(readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), "../package.json"))).version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e583b8de599ee380 — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2dsv.js:30

rw.dash.readFile(program.args[0] || "-", (error, text) => {
  if (error) throw error;
  rw.dash.writeFile("-", iconv.encode(outFormat.format(inFormat.parse(iconv.decode(text, options.inputEncoding))) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0501f8f69cfdd86b — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2dsv.js:32

  rw.dash.writeFile("-", iconv.encode(outFormat.format(inFormat.parse(iconv.decode(text, options.inputEncoding))) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e8ef10dfaad6c101 — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2json.js:5

import {readFileSync} from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42ce6339179a9eeb — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2json.js:16

    .version(JSON.parse(readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), "../package.json"))).version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0097f1a0d18dd15d — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2json.js:29

rw.dash.readFile(program.args[0] || "-", (error, text) => {
  if (error) throw error;
  const rowConverter = options.autoType ? dsv.autoType : null
  const rows = inFormat.parse(iconv.decode(text, options.inputEncoding), rowConverter);
  rw.dash.writeFile(options.out, iconv.encode(options.newlineDelimited
      ? rows.map((row) => JSON.stringify(row)).join("\n") + "\n"
      : JSON.stringify(rows) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #72951d7883066267 — Filesystem access.

pkgs/npm/[email protected]/bin/dsv2json.js:33

  rw.dash.writeFile(options.out, iconv.encode(options.newlineDelimited
      ? rows.map((row) => JSON.stringify(row)).join("\n") + "\n"
      : JSON.stringify(rows) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a1608a9d54d5917 — Filesystem access.

pkgs/npm/[email protected]/bin/json2dsv.js:5

import {readFileSync} from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c78348ae9837bbf8 — Filesystem access.

pkgs/npm/[email protected]/bin/json2dsv.js:16

    .version(JSON.parse(readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), "../package.json"))).version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cd1594e543a2848a — Filesystem access.

pkgs/npm/[email protected]/bin/json2dsv.js:28

rw.dash.readFile(program.args[0] || "-", (error, text) => {
  if (error) throw error;
  text = iconv.decode(text, options.inputEncoding);
  rw.dash.writeFile(options.out, iconv.encode(outFormat.format(options.newlineDelimited
      ? text.trim().split(/\r?\n/g).map((line) => JSON.parse(line))
      : JSON.parse(text)) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #1f0602eabf6819c9 — Filesystem access.

pkgs/npm/[email protected]/bin/json2dsv.js:31

  rw.dash.writeFile(options.out, iconv.encode(outFormat.format(options.newlineDelimited
      ? text.trim().split(/\r?\n/g).map((line) => JSON.parse(line))
      : JSON.parse(text)) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gpt-tokenizer

npm dependency

expand_more 24 low-confidence finding(s)

low env_fs dependency Excluded from app score #88714a9cf6a80394 — Filesystem access.

pkgs/npm/[email protected]/cjs/GptEncoding.test.js:39

const fs_1 = __importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cdb2bab532b1fc28 — Filesystem access.

pkgs/npm/[email protected]/cjs/GptEncoding.test.js:418

    const testPlanData = fs_1.default.readFileSync(testPlanPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca342b48f8e848f0 — Filesystem access.

pkgs/npm/[email protected]/esm/GptEncoding.test.js:1

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ac0838bb609fce27 — Filesystem access.

pkgs/npm/[email protected]/esm/GptEncoding.test.js:381

    const testPlanData = fs.readFileSync(testPlanPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #da4b1cdcd328f5ea — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateByModel.js:1

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9bf79777814ab00a — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateByModel.js:35

const template = await fs.readFile(path.join(__dirname, '../encoding/cl100k_base.ts'), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b3a02d0c0225cece — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateByModel.js:68

    await fs.writeFile(path.join(__dirname, `../model/${modelName}.ts`), content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7760ae39cb2e1fc0 — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:2

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c83146c45ed0a581 — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:20

await fs.writeFile(path.join(__dirname, '../modelsChatEnabled.gen.ts'), tsFileContent);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eddcad6139cf590f — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:2

import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #941c878775d0bfdb — Environment-variable access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:5

const DEBUG = process.env.DEBUG === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #644f1e7eb819ba06 — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:47

    const bpeFile = await fs.readFile(filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5d44229b863f2661 — Filesystem access.

pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:105

    await fs.writeFile(path.join(__dirname, `../bpeRanks/${modelName}.js`), `${preamble}
${jsCodeConstsForEachChunk.join('\n')}
/** @type {(string | number[])[]} */
const bpe = ${jsCodeBpeArray};
${jsCodeToResetHelperArrays.join('\n')}
export default bpe;`);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bbabe3e337595885 — Filesystem access.

pkgs/npm/[email protected]/src/GptEncoding.test.ts:1

import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #629b31e210dc2093 — Filesystem access.

pkgs/npm/[email protected]/src/GptEncoding.test.ts:500

  const testPlanData = fs.readFileSync(testPlanPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0ae6227553cee3d9 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateByModel.ts:1

import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e7b495b9970e69d2 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateByModel.ts:55

const template = await fs.readFile(
  path.join(__dirname, '../encoding/cl100k_base.ts'),
  'utf8',
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c139b68a421fe658 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateByModel.ts:111

    await fs.writeFile(
      path.join(__dirname, `../model/${modelName}.ts`),
      content,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d45cf1e91230f4c7 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:2

import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6991b4a5a7b14c12 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:31

await fs.writeFile(
  path.join(__dirname, '../modelsChatEnabled.gen.ts'),
  tsFileContent,
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7af969b1249b40c3 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:2

import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #842096b6336c870a — Environment-variable access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:7

const DEBUG = process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42a985bb6573baf1 — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:57

    const bpeFile = await fs.readFile(filePath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fe458b2e407a036f — Filesystem access.

pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:138

    await fs.writeFile(
      path.join(__dirname, `../bpeRanks/${modelName}.js`),
      `${preamble}
${jsCodeConstsForEachChunk.join('\n')}
/** @type {(string | number[])[]} */
const bpe = ${jsCodeBpeArray};
${jsCodeToResetHelperArrays.join('\n')}
export default bpe;`,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

i18next-resources-to-backend

npm dependency

expand_more 2 low-confidence finding(s)

low env_fs dependency Excluded from app score #bb1385dde6286ab3 — Filesystem access.

pkgs/npm/[email protected]/rollup.config.js:5

import { readFileSync } from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9a4ef0786acc5a1d — Filesystem access.

pkgs/npm/[email protected]/rollup.config.js:6

const pkg = JSON.parse(readFileSync(new URL('package.json', import.meta.url)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mammoth

npm dependency

expand_more 3 low-confidence finding(s)

low env_fs dependency Excluded from app score #55bb1ec64013e738 — Filesystem access.

pkgs/npm/[email protected]/lib/docx/files.js:1

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #36174c9cfcf21865 — Filesystem access.

pkgs/npm/[email protected]/lib/main.js:3

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7095b91cd32f16d — Filesystem access.

pkgs/npm/[email protected]/lib/unzip.js:1

var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

next-pwa

npm dependency

expand_more 16 low-confidence finding(s)

low env_fs dependency Excluded from app score #0398ec10b023a773 — Filesystem access.

pkgs/npm/[email protected]/build-custom-worker.js:4

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b467572e63208fd3 — Filesystem access.

pkgs/npm/[email protected]/build-fallback-worker.js:4

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2d7149affddb35ac — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:7

      if (process.env.__PWA_FALLBACK_DOCUMENT__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #dd28ad3f0a327f27 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:8

        return caches.match(process.env.__PWA_FALLBACK_DOCUMENT__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bc7a4f755ef72e18 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:10

      if (process.env.__PWA_FALLBACK_IMAGE__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d09436744689a654 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:11

        return caches.match(process.env.__PWA_FALLBACK_IMAGE__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7ced1c705210b091 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:13

      if (process.env.__PWA_FALLBACK_AUDIO__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #09663c96139d86e3 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:14

        return caches.match(process.env.__PWA_FALLBACK_AUDIO__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #912417bca8921a16 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:16

      if (process.env.__PWA_FALLBACK_VIDEO__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #47c9a13648dc9380 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:17

        return caches.match(process.env.__PWA_FALLBACK_VIDEO__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #cbf6d7f4722aea6f — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:19

      if (process.env.__PWA_FALLBACK_FONT__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #82b49b34811f1b20 — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:20

        return caches.match(process.env.__PWA_FALLBACK_FONT__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #029e7b8b2593155c — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:22

      if (process.env.__PWA_FALLBACK_DATA__ && request.url.match(/\/_next\/data\/.+\/.+\.json$/i))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #aab58a796457c70e — Environment-variable access.

pkgs/npm/[email protected]/fallback.js:23

        return caches.match(process.env.__PWA_FALLBACK_DATA__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #510405e288990b5a — Filesystem access.

pkgs/npm/[email protected]/index.js:4

const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e32edd7fa84902d6 — Filesystem access.

pkgs/npm/[email protected]/index.js:13

const getRevision = file => crypto.createHash('md5').update(fs.readFileSync(file)).digest('hex')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

next-themes

npm dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #82ee12fbc43ecd50 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:4

  forbidOnly: !!process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #91d1b8c1ac729a01 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:5

  retries: process.env.CI ? 2 : 0,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ad7969ad669265ab — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:6

  reporter: process.env.CI ? 'github' : 'list',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9f468bfe8f9e47d6 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:11

    reuseExistingServer: !process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

npm dependency

expand_more 9 low-confidence finding(s)

low egress dependency Excluded from app score #1d3a74b9292e1268 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.js:50

            const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #f616893240704ab8 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.js:97

            const url = new URL(`http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #be6a10164c3c476a — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.mjs:44

            const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #2d389f5757e065d4 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/auth/subject-token-providers.mjs:91

            const url = new URL(`http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #822a2c379069b611 — Environment-variable access.

pkgs/npm/[email protected]/azure.js:44

                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3bd3a37c36bbbc91 — Environment-variable access.

pkgs/npm/[email protected]/azure.mjs:40

                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low egress dependency Excluded from app score #c2c99c73863c9bac — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:81

      const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress dependency Excluded from app score #1df7b31d52a8a234 — Hardcoded external endpoint. Review what data is sent to this destination.

pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:145

      const url = new URL(
        `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`,
      );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low env_fs dependency Excluded from app score #8dafae657179e696 — Environment-variable access.

pkgs/npm/[email protected]/src/azure.ts:101

        endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pdf-parse

npm dependency

expand_more 9 low-confidence finding(s)

low env_fs dependency Excluded from app score #f030e1402270e5ab — Filesystem access.

pkgs/npm/[email protected]/bin/cli.mjs:27

	const pkg = JSON.parse(await readFile(new URL('../package.json', import.meta.url)));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #bdb74682d400f476 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.mjs:103

		const data = await readFile(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #42810e67007b3860 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.mjs:156

		await writeFile(options.output, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #df55d5ad2ad70237 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.mjs:167

		await writeFile(options.output, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ed23e478fc705812 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.mjs:179

		await writeFile(options.output, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0f2265a94781b1c6 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.mjs:208

				await writeFile(filepath, image.data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c19a37b39e996918 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.mjs:278

			await writeFile(filepath, page.data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ee6e7a89abc87b30 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.test.mjs:59

	await fs.writeFile(dummyFile, 'dummy content');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #44e011c77a0824b3 — Filesystem access.

pkgs/npm/[email protected]/bin/cli.test.mjs:90

	await fs.writeFile(dummyFile, 'dummy content');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react

npm dependency

expand_more 14 low-confidence finding(s)

low env_fs dependency Excluded from app score #afe70c54aa42591d — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-compiler-runtime.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #48ef4377f42e081c — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #6f23f5f8362fd409 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #57d9eecdc6341074 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-runtime.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9dc13b52fbcb0cd1 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-jsx-runtime.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #808a083115948b48 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #b7d3631315a8571e — Environment-variable access.

pkgs/npm/[email protected]/cjs/react.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #ca8e525ae307bccd — Environment-variable access.

pkgs/npm/[email protected]/compiler-runtime.js:10

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #fb097ea450d8e229 — Environment-variable access.

pkgs/npm/[email protected]/index.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #895fec02c62aa13f — Environment-variable access.

pkgs/npm/[email protected]/jsx-dev-runtime.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0cc881d0a34f3c8b — Environment-variable access.

pkgs/npm/[email protected]/jsx-dev-runtime.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2897a1346ee1ee2d — Environment-variable access.

pkgs/npm/[email protected]/jsx-runtime.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #2041230a769dc14f — Environment-variable access.

pkgs/npm/[email protected]/jsx-runtime.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #43343d8c37636681 — Environment-variable access.

pkgs/npm/[email protected]/react.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-dom

npm dependency

expand_more 24 low-confidence finding(s)

low env_fs dependency Excluded from app score #51d25a1dbb13c260 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-profiling.development.js:15

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #221616ee2fc69ecc — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server-legacy.browser.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5e0162bd873c0618 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server-legacy.node.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c2dba4c7570be0c3 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server.browser.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #3c2909348be1f25f — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server.edge.development.js:36

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #639eb25944f3433c — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-server.node.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #92a520192fd38af3 — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom-test-utils.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9410f05a994ca76e — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #484e2b9b3751d87c — Environment-variable access.

pkgs/npm/[email protected]/cjs/react-dom.react-server.development.js:12

"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0bc850d9a68d7488 — Environment-variable access.

pkgs/npm/[email protected]/client.js:11

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #877d646cfa053bb1 — Environment-variable access.

pkgs/npm/[email protected]/client.js:31

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #27e7a47f1c81a3c9 — Environment-variable access.

pkgs/npm/[email protected]/index.js:11

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #eebcfdea7e145e34 — Environment-variable access.

pkgs/npm/[email protected]/index.js:31

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #20f4192038558499 — Environment-variable access.

pkgs/npm/[email protected]/profiling.js:11

  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0e72e017aaf90bac — Environment-variable access.

pkgs/npm/[email protected]/profiling.js:31

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #0a3ff48b797454ff — Environment-variable access.

pkgs/npm/[email protected]/react-dom.react-server.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #5bfca67e9154d486 — Environment-variable access.

pkgs/npm/[email protected]/server.browser.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #9ba1d88220e6b574 — Environment-variable access.

pkgs/npm/[email protected]/server.bun.js:5

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #f0845b1f8e35ac4b — Environment-variable access.

pkgs/npm/[email protected]/server.edge.js:5

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #d32aaf9361bc4e97 — Environment-variable access.

pkgs/npm/[email protected]/server.node.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #7749537284198cdd — Environment-variable access.

pkgs/npm/[email protected]/static.browser.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #e706143900d34455 — Environment-variable access.

pkgs/npm/[email protected]/static.edge.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a4dc251f41f6b450 — Environment-variable access.

pkgs/npm/[email protected]/static.node.js:4

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #c53109170d8e6bb4 — Environment-variable access.

pkgs/npm/[email protected]/test-utils.js:3

if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-hook-form

npm dependency

expand_more 8 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #377b4ac0e8909fee — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/apiExtractor.js:3

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #71309569d0556f05 — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/apiExtractor.js:64

  const report = fs.readFileSync(config.reportFilePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #cd55d4c08b581504 — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/bench-compare.ts:10

import { copyFileSync, existsSync, mkdirSync, unlinkSync } from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9cdb86a950fdd630 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/scripts/jest/jest.config.js:44

  const testEnv = process.env.TEST_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #7f9c533beed64ab6 — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-cjs-exports.cjs:9

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #21c2c15c82e9bea7 — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-cjs-exports.cjs:15

  fs.readFileSync(
    require('path').resolve(__dirname, './all-exports.json'),
    'utf-8',
  ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a0a61602cbbce977 — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-esm-exports.mjs:9

import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #69897e1e8bb0c414 — Filesystem access.

pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-esm-exports.mjs:20

  fs.readFileSync(path.resolve(__dirname, './all-exports.json'), 'utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-syntax-highlighter

npm dependency

expand_more 24 low-confidence finding(s)

low env_fs tooling Excluded from app score unknown #5767a783c761c816 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:6

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a8d726849efe1814 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:34

  fs.writeFile(
    path.join(__dirname, `../src/async-languages/hljs.js`),
    lines.join('\n'),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #b25eefe2ef9aefab — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:50

  fs.writeFile(
    path.join(__dirname, `../src/languages/hljs/supported-languages.js`),
    lines.join(''),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #9f16229614aefbcd — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:70

  fs.writeFile(
    path.join(__dirname, `../src/languages/hljs/${file}`),
    lines.join(';\n'),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #030e5bccb691bc31 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:103

    fs.writeFile(
      path.join(__dirname, '../AVAILABLE_LANGUAGES_HLJS.MD'),
      languageMD,
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5dcaa1168613a577 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:117

    fs.writeFile(
      path.join(__dirname, '../src/languages/hljs/index.js'),
      defaultExports.join(''),
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #2139259c7ab5a32c — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-refractor.js:6

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #da4db02c4e9f4f2b — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-refractor.js:30

  fs.writeFile(
    path.join(__dirname, `../src/languages/prism/${file}`),
    lines.join(';\n'),
    err => {
      if (err) {
        process.exit(1);
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #50e98586d6ede752 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-refractor.js:53

  fs.writeFile(
    path.join(__dirname, `../src/languages/prism/supported-languages.js`),
    lines.join(''),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #3c4b3d3694bd509c — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-refractor.js:73

  fs.writeFile(
    path.join(__dirname, `../src/async-languages/prism.js`),
    lines.join('\n'),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #7bbdf9438df7a53a — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-refractor.js:108

    fs.writeFile(
      path.join(__dirname, '../AVAILABLE_LANGUAGES_PRISM.MD'),
      languageMD,
      err => {
        if (err) {
          process.exit(1);
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #912399d8c46b7724 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-languages-refractor.js:122

    fs.writeFile(
      path.join(__dirname, '../src/languages/prism/index.js'),
      defaultExports.join(''),
      err => {
        if (err) {
          process.exit(1);
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5c46b675f85b583c — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:6

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #702d25d26d0723dd — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:35

    fs.writeFile(
      path.join(__dirname, '../AVAILABLE_STYLES_HLJS.MD'),
      styleMD,
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #a1ff0a1901117a08 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:44

    fs.writeFile(
      path.join(__dirname, '../src/styles/hljs/index.js'),
      defaultExports.join(''),
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #6a7ee0cc5da470d6 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:57

    fs.writeFile(
      path.join(__dirname, '../demo/styles/hljs.js'),
      demoStylesArray,
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #6f513c7f37da76c5 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:75

  fs.readFile(
    path.join(__dirname, `../node_modules/highlight.js/styles/${file}`),
    'utf-8',
    (err, data) => {
      if (err) {
        throw err;
      }
      const javacriptStylesheet = css
        .parse(data)
        .stylesheet.rules.reduce((sheet, rule) => {
          if (rule.type === 'rule') {
            const style = rule.selectors.reduce((selectors, selector) => {
              if (!selector.includes(ignoreStyleWithThis)) {
                const selectorObject = rule.declarations.reduce(
                  (declarations, declaration) => {
                    if (
                      declaration.type === 'declaration' &&
                      declaration.property
                    ) {
                      declarations[camel(declaration.property)] =
                        declaration.value;
                    }
                    return declarations;
                  },
                  {}
                );
                selectors[selector.substring(1)] = selectorObject;
              }
              return selectors;
            }, {});
            sheet = Object.keys(style).reduce((stylesheet, selector) => {
              if (stylesheet[selector]) {
                stylesheet[selector] = Object.assign(
                  {},
                  stylesheet[selector],
                  style[selector]
                );
              } else {
                stylesheet[selector] = style[selector];
              }
              return stylesheet;
            }, sheet);
          }
          return sheet;
        }, {});
      fs.writeFile(
        path.join(__dirname, `../src/styles/hljs/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        err => {
          if (err) {
            throw err;
          }
        }
      );
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #95a52447a6456257 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:120

      fs.writeFile(
        path.join(__dirname, `../src/styles/hljs/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        err => {
          if (err) {
            throw err;
          }
        }
      );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #5f4f80ad6a7574d5 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:3

const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #c3199f0d3c9f517e — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:53

  fs.writeFile(
    path.join(__dirname, '../AVAILABLE_STYLES_PRISM.MD'),
    styleMD,
    () => {}
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #cce265677a0e406a — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:58

  fs.writeFile(
    path.join(__dirname, '../src/styles/prism/index.js'),
    defaultExports.join(''),
    () => {}
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #1ac9ff03f103dae5 — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:67

  fs.writeFile(
    path.join(__dirname, '../demo/styles/prism.js'),
    demoStylesArray,
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #4e7ea106d3a4c29f — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:82

  fs.readFile(
    path.join(__dirname, `${directory}/${file}`),
    'utf-8',
    (err, data) => {
      const javacriptStylesheet = css
        .parse(data)
        .stylesheet.rules.reduce((sheet, rule) => {
          if (rule.type === 'rule') {
            const style = rule.selectors.reduce((selectors, selector) => {
              const selectorObject = rule.declarations.reduce(
                (declarations, declaration) => {
                  if (
                    declaration.type === 'declaration' &&
                    declaration.property
                  ) {
                    const camelCaseDeclarationProp = camel(
                      declaration.property
                    );
                    const key =
                      camelCaseDeclarationProp.includes('moz') ||
                      camelCaseDeclarationProp.includes('webkit') ||
                      (camelCaseDeclarationProp[0] === 'o' &&
                        !camelCaseDeclarationProp.includes('overflow'))
                        ? `${camelCaseDeclarationProp
                            .substring(0, 1)
                            .toUpperCase()}${camelCaseDeclarationProp.substring(
                            1
                          )}`
                        : camelCaseDeclarationProp;
                    declarations[key] = declaration.value;
                  }
                  return declarations;
                },
                {}
              );

              if (selector.substring(0, 6) === '.token') {
                selector = selector.substring(7);

                // Regex to fix Prism theme selectors
                // - Remove further `.token` classes
                // - Remove the space (descendant combinator)
                //   to allow for styling multiple classes
                //   Ref: https://github.com/react-syntax-highlighter/react-syntax-highlighter/pull/305
                selector = selector.replace(/(?<=\w) (\.token)?(?=\.)/g, '');
              }
              selectors[selector] = selectorObject;
              return selectors;
            }, {});
            sheet = Object.keys(style).reduce((stylesheet, selector) => {
              if (stylesheet[selector]) {
                stylesheet[selector] = Object.assign(
                  {},
                  stylesheet[selector],
                  style[selector]
                );
              } else {
                stylesheet[selector] = style[selector];
              }
              return stylesheet;
            }, sheet);
          }
          return sheet;
        }, {});
      fs.writeFile(
        path.join(__dirname, `../src/styles/prism/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        () => {}
      );
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs tooling Excluded from app score unknown #098f3bab2fd0339f — Filesystem access.

pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:146

      fs.writeFile(
        path.join(__dirname, `../src/styles/prism/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        () => {}
      );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-textarea-autosize

npm dependency

expand_more 1 low-confidence finding(s)

low env_fs dependency Excluded from app score #5dd155046290a177 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/.babelrc.js:1

const test = process.env.NODE_ENV === 'test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sonner

npm dependency

expand_more 4 low-confidence finding(s)

low env_fs dependency Excluded from app score #7965935776d70957 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:26

  forbidOnly: !!process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #15d75c0a55b614ec — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:28

  retries: process.env.CI ? 2 : 0,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9288e11362cc466 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:30

  workers: process.env.CI ? 1 : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

low env_fs dependency Excluded from app score #a9f4ac76c1807483 — Environment-variable access.

pkgs/npm/[email protected]__reposrc/playwright.config.ts:42

    reuseExistingServer: !process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

next prod — tarball exceeds byte cap

verified_user Application data leak confirmed

App Privacy Score

bar_chart Score Breakdown

list Scan Summary

swap_horiz Confirmed data exfiltration in application code

</> First-Party Code

first-party (npm)

</> Dependencies

ai

@google/generative-ai

@anthropic-ai/sdk

@apidevtools/json-schema-ref-parser

@hookform/resolvers

@mistralai/mistralai

@radix-ui/react-avatar

@radix-ui/react-context-menu

@supabase/ssr

@vercel/edge-config

@xenova/transformers

class-variance-authority

d3-dsv

gpt-tokenizer

i18next-resources-to-backend

mammoth

next-pwa

next-themes

openai

pdf-parse

react

react-dom

react-hook-form

react-syntax-highlighter

react-textarea-autosize

sonner

Skipped dependencies