Close Open Privacy Scan

bolt Snapshot: commit 16cb6eb
science engine v1.23
schedule 2026-07-26T04:06:23.813042+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

67 /100
Medium privacy risk

Medium risk · 1479 finding(s)

Based on: 1 first-party package(s) · 6/7 deps analyzed

Dependency score: 82 (Low risk)

bar_chart Score Breakdown

telemetry −20
egress −10
env_fs −3

list Scan Summary

0 high 2 medium 1477 low
First-party packages: 1
Dependency packages: 6
Ecosystem: python

swap_horiz External domains

687fb701029421ae5549d998--8000.hf.jobsaggregate.ee.engr.uky.eduapi-inference.huggingface.coapi.cerebras.aiapi.cohere.comapi.deepinfra.comapi.endpoints.huggingface.cloudapi.featherless.aiapi.fireworks.aiapi.github.comapi.groq.comapi.novita.aiapi.nuget.orgapi.openai.comapi.publicai.coapi.replicate.comapi.scaleway.aiapi.together.xyzapi.wavespeed.aiapi.z.aiarstechnica.comarxiv.orgblog.famzah.netbootlin.combugreports.qt.iobugs.python.orgbugs.winehq.orgbugzilla.gnome.orgcdn.britannica.comcdn.mathjax.orgcens.ioc.eecode.activestate.comcolab.research.google.comconsoledonottrack.comcoqui.aicrates.iodata-apis.orgdatasets-server.huggingface.codev-discuss.pytorch.orgdeveloper.android.comdeveloper.mozilla.orgdigitalassets.lib.berkeley.edudiscord.comdmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdocs.github.comdocs.microsoft.comdocs.nvidia.comdocs.pytest.orgdocs.python.orgdocs.rsdocs.scipy.orgdoi.orgdvc.orgen.wikipedia.orgendpoints.huggingface.cofal.runfilesystem-spec.readthedocs.ioformulae.brew.shgcc.gnu.orggit-scm.comgit.kernel.orggithub.comgitlab.comgitlab.freedesktop.orggraphics.stanford.edugroups.google.comhf.cohub-ci.huggingface.cohub.my-company.comhuggingface.coimageio.readthedocs.ioinference.api.nscale.comipython.orgj3-fortran.orgjson-schema.orgjzgu0buei5.us-east-1.aws.endpoints.huggingface.cloudkeras.iolibsdl.orglinuxdevcenter.comlists.sourceforge.netmail.python.orgmathworld.wolfram.commatplotlib.orgmesonbuild.commetacpan.orgmy-text-to-image.region.vendor.endpoints.huggingface.cloudndjson.orgnew-url.comnew.webhook.sitenicolas.limare.netnumpy.orgnumpydoc.readthedocs.iooai.endpoints.kepler.ai.cloud.ovh.netonnxruntime.aipackages.msys2.orgpackaging.python.orgpandas.pydata.orgpeople.eecs.berkeley.edupersonal.math.ubc.caplatform.openai.compyinstaller.readthedocs.iopypi.orgpytorch.orgpyyaml.orgqueue.fal.runraw.githubusercontent.comrefspecs.linuxfoundation.orgrequests.readthedocs.iorouter.huggingface.coschemas.microsoft.comscikit-image.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgserverfault.comsourceware.orgstackoverflow.comstorage.googleapis.comtldp.orgtruststore.readthedocs.iotvm.apache.orgtyping.python.orgupload.wikimedia.orgviews.scientific-python.orgweb.archive.orgwebhook.sitewixtoolset.orgwrapdb.mesonbuild.comwww.ams.orgwww.brynosaurus.comwww.comet.comwww.deepspeed.aiwww.ecma-international.orgwww.google.comwww.ietf.orgwww.intel.comwww.math.hmc.eduwww.mathjax.orgwww.mathworks.comwww.oasis-open.orgwww.openblas.netwww.python-httpx.orgwww.scipy.orgwww.scivision.devwww.stixfonts.orgwww.systutorials.comwww.w3.orgwww.xyz.edux.com

</> First-Party Code

first-party (python)

python first-party
medium telemetry production #826596f8d9937091 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/accelerate/tracking.py:651
            self.writer.track(value, name=key, step=step, **kwargs)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

medium telemetry production #7391381170990440 capability detected · no path traced Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/src/accelerate/tracking.py:683
            self.writer.track(aim_image, name=key, step=step, **track_kw)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.

expand_more 267 low-confidence finding(s)
low env_fs Filesystem access. 43 locations
low env_fs Environment-variable access. 224 locations

</> Dependencies

huggingface_hub

python dependency
expand_more 185 low-confidence finding(s)
low env_fs Filesystem access. 64 locations
low env_fs Environment-variable access. 57 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 62 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 2 locations

numpy

python dependency
expand_more 982 low-confidence finding(s)
low env_fs Filesystem access. 618 locations
low env_fs Environment-variable access. 356 locations
low egress Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress Hardcoded external endpoint. Review what data is sent to this destination. 3 locations

packaging

python dependency

psutil

python dependency
expand_more 28 low-confidence finding(s)
low env_fs Filesystem access. 19 locations
low env_fs Environment-variable access. 7 locations
low egress tooling reachable #d1aec57c11fc97b2 capability detected · no path traced Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:194
            res = requests.get(url, timeout=REQUEST_TIMEOUT)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

low egress tooling reachable #2a747a4c411c09bd capability detected · no path traced Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/install_pip.py:34
        req = urlopen(URL, **kwargs)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pyyaml

python dependency
expand_more 3 low-confidence finding(s)

Skipped dependencies

Production

  • torch prod — no sdist (wheels only)