Close Open Privacy Scan

link https://github.com/chroma-core/chroma
bolt Snapshot: commit cd489f8
science engine v3
schedule 2026-07-11T03:09:32.132470+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

App Privacy Score

97 /100
Low privacy risk

Low risk · 269 finding(s)

Dependency score: 82 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 1 medium 268 low
First-party packages: 2
Dependency packages: 22
Ecosystem: go

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (1)
medium google.golang.org/protobuf dependency PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:285 → pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:288

</> First-Party Code

first-party (go): go

go first-party
expand_more 5 low-confidence finding(s)
low env_fs production #546491851d7d0d30 — Filesystem access.
repo/go/pkg/grpcutils/service.go:65 
		caBytes, err := os.ReadFile(grpcConfig.CAPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5127c89e805da91a — Environment-variable access.
repo/go/pkg/grpcutils/service.go:82 
	OPTL_TRACING_ENDPOINT := os.Getenv("OPTL_TRACING_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6b7c92b8cab981f5 — Environment-variable access.
repo/go/pkg/leader/election.go:35 
	podName, _ := os.LookupEnv("POD_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92838990d48f8aaa — Environment-variable access.
repo/go/pkg/leader/election.go:40 
	namespace, _ := os.LookupEnv("POD_NAMESPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c735068a8226998 — Environment-variable access.
repo/go/pkg/utils/integration.go:13 
	envVarValue := os.Getenv(environmentVariable)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (python)

go first-party
expand_more 5 low-confidence finding(s)
low env_fs production #546491851d7d0d30 — Filesystem access.
repo/go/pkg/grpcutils/service.go:65 
		caBytes, err := os.ReadFile(grpcConfig.CAPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5127c89e805da91a — Environment-variable access.
repo/go/pkg/grpcutils/service.go:82 
	OPTL_TRACING_ENDPOINT := os.Getenv("OPTL_TRACING_ENDPOINT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6b7c92b8cab981f5 — Environment-variable access.
repo/go/pkg/leader/election.go:35 
	podName, _ := os.LookupEnv("POD_NAME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92838990d48f8aaa — Environment-variable access.
repo/go/pkg/leader/election.go:40 
	namespace, _ := os.LookupEnv("POD_NAMESPACE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c735068a8226998 — Environment-variable access.
repo/go/pkg/utils/integration.go:13 
	envVarValue := os.Getenv(environmentVariable)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

google.golang.org/protobuf

go dependency
medium pii_flow dependency Excluded from app score #9166432141e6674f — PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:288 · flow /tmp/closeopen-yzr99f7y/pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:285 → /tmp/closeopen-yzr99f7y/pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:288 
		fmt.Printf("executing: %v\n%s\n", strings.Join(cmd.Args, " "), out)

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 19 low-confidence finding(s)
low env_fs dependency Excluded from app score #eacd3d739023487b — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:117 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/wirefuzz/corpus/%x", sha1.Sum(wire)), wire, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b2e1d4ac3fe178f — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:125 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/textfuzz/corpus/%x", sha1.Sum(text)), text, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43fe0d645b92f1c3 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-corpus/main.go:133 
		if err := os.WriteFile(fmt.Sprintf("internal/fuzz/jsonfuzz/corpus/%x", sha1.Sum(json)), json, 0777); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #999e9f315985ed6c — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:45 
	if plugin := os.Getenv("RUN_AS_PROTOC_PLUGIN"); plugin != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a80ea412d7973c7e — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:84 
	flag.StringVar(&protoRoot, "protoroot", os.Getenv("PROTOBUF_ROOT"), "The root of the protobuf source tree.")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4348dbe6320b20e0 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:199 
			check(os.WriteFile(filepath.Join(tmpDir, filepath.FromSlash(d.path+"/gen_test.go")), b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5446644a0454d2e — Environment-variable access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:285 
	cmd.Env = append(os.Environ(), "RUN_AS_PROTOC_PLUGIN=1")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f648bb08e91d487 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:469 
	src, err := os.ReadFile(srcPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #709e6ef6d3f933fd — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:472 
	dst, _ := os.ReadFile(dstPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f0db0cdebb8572c — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-protos/main.go:476 
	check(os.WriteFile(dstPath, src, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68ce14570487851d — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:261 
		prev, _ := os.ReadFile(absFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1242ea3e65f5012 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:264 
			check(os.WriteFile(absFile, b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #057f73d390d74f66 — Filesystem access.
pkgs/go/[email protected]/internal/cmd/generate-types/main.go:267 
		check(os.WriteFile(absFile+".tmp", b, 0664))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #742fab5b8129ed6f — Filesystem access.
pkgs/go/[email protected]/internal/cmd/pbdump/pbdump.go:121 
		b, err := os.ReadFile(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eabc1044977d6c26 — Filesystem access.
pkgs/go/[email protected]/internal/detrand/rand.go:46 
	f, err := os.Open(s)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a779ef26b075b04 — Filesystem access.
pkgs/go/[email protected]/internal/fuzztest/fuzztest.go:20 
	dir, err := os.Open(*corpus)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4d22f29d0be9559 — Filesystem access.
pkgs/go/[email protected]/internal/fuzztest/fuzztest.go:36 
			b, err := os.ReadFile(filepath.Join(*corpus, name))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08a73a4c3201fbee — Environment-variable access.
pkgs/go/[email protected]/reflect/protoregistry/registry.go:51 
	if v := os.Getenv(env); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dfd67d8cdb634eff — Environment-variable access.
pkgs/go/[email protected]/reflect/protoregistry/registry.go:63 
		panic("invalid " + env + " value: " + os.Getenv(env))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

ariga.io/atlas-provider-gorm

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #8583d919f56c4876 — Filesystem access.
pkgs/go/[email protected]/main.go:83 
	if err := os.WriteFile(target, src, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2

go dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #63c1b6b192af0aa9 — Filesystem access.
pkgs/go/[email protected]/aws/generate.go:29 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ea5cb499a7d531e — Filesystem access.
pkgs/go/[email protected]/aws/logging_generate.go:85 
	file, err := os.Create("logging.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a9f68266f60c527 — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/recursion_detection.go:40 
	_, hasLambdaEnv := os.LookupEnv(envAwsLambdaFunctionName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a61579bd7afcf1c8 — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/recursion_detection.go:41 
	xAmznTraceID, hasTraceID := os.LookupEnv(envAmznTraceID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9262abffa3066e0 — Environment-variable access.
pkgs/go/[email protected]/aws/middleware/user_agent.go:201 
	if ev := os.Getenv(execEnvVar); len(ev) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b34d25191cbb3bfe — Environment-variable access.
pkgs/go/[email protected]/internal/awstesting/util.go:106 
	originalEnv := os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3172198074a26cfd — Environment-variable access.
pkgs/go/[email protected]/internal/awstesting/util.go:150 
		if val, ok := os.LookupEnv(env); ok && len(val) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7be97dfe8e74ef56 — Filesystem access.
pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:90 
	modelFile, err := os.Open(modelFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64152c1558a11cf6 — Filesystem access.
pkgs/go/[email protected]/internal/endpoints/awsrulesfn/internal/partition/codegen.go:101 
	file, err := os.Create(outputFilename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/config

go dependency
expand_more 33 low-confidence finding(s)
low env_fs dependency Excluded from app score #4ba70b27c0ff2633 — Filesystem access.
pkgs/go/[email protected]/codegen/main.go:94 
	file, err := os.OpenFile(config.OutputPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0744)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b9759b0a6b94cb6e — Environment-variable access.
pkgs/go/[email protected]/config.go:215 
	if os.Getenv(awsProfileEnvVar) != "" || options.SharedConfigProfile != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b513214170016a2 — Environment-variable access.
pkgs/go/[email protected]/defaultsmode.go:43 
		EnvironmentIdentifier:     aws.ExecutionEnvironmentID(os.Getenv(execEnvVar)),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55e87ae83636f311 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:318 
		creds.AccountID = os.Getenv(awsAccountIDEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8da4671d845e069f — Environment-variable access.
pkgs/go/[email protected]/env_config.go:319 
		creds.SessionToken = os.Getenv(awsSessionTokenEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #814dacca6a3d553e — Environment-variable access.
pkgs/go/[email protected]/env_config.go:323 
	cfg.ContainerCredentialsEndpoint = os.Getenv(awsContainerCredentialsEndpointEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8575b7339ab3fc5 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:324 
	cfg.ContainerCredentialsRelativePath = os.Getenv(awsContainerCredentialsRelativePathEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c91c8b6046db46e — Environment-variable access.
pkgs/go/[email protected]/env_config.go:325 
	cfg.ContainerAuthorizationToken = os.Getenv(awsContainerPProviderAuthorizationEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f926aaa60a475dad — Environment-variable access.
pkgs/go/[email protected]/env_config.go:330 
	cfg.SharedCredentialsFile = os.Getenv(awsSharedCredentialsFileEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0dccafc5eb653eb7 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:331 
	cfg.SharedConfigFile = os.Getenv(awsConfigFileEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f2cdca366f36166 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:333 
	cfg.CustomCABundle = os.Getenv(awsCustomCABundleEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #211da13ab98adfae — Environment-variable access.
pkgs/go/[email protected]/env_config.go:335 
	cfg.WebIdentityTokenFilePath = os.Getenv(awsWebIdentityTokenFilePathEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c01129358fc22df — Environment-variable access.
pkgs/go/[email protected]/env_config.go:337 
	cfg.RoleARN = os.Getenv(awsRoleARNEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c328c8c2bb6f630c — Environment-variable access.
pkgs/go/[email protected]/env_config.go:338 
	cfg.RoleSessionName = os.Getenv(awsRoleSessionNameEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4ec58e7199f8bc19 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:340 
	cfg.AppID = os.Getenv(awsSdkAppID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1f2c608d0c2ea8c6 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:361 
	cfg.EC2IMDSEndpoint = os.Getenv(awsEc2MetadataServiceEndpointEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2819f8a033443fe — Environment-variable access.
pkgs/go/[email protected]/env_config.go:455 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55ee01a6f85a3985 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:473 
		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1227eeae39b127c — Environment-variable access.
pkgs/go/[email protected]/env_config.go:485 
		if value := os.Getenv(k); len(value) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a3b6c55c12ac876 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:498 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1395e1fd823679b2 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:511 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d302d00b5014638a — Filesystem access.
pkgs/go/[email protected]/env_config.go:587 
	b, err := ioutil.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #deda4b07dcf16785 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:611 
	if endpt := os.Getenv(fmt.Sprintf("%s_%s", awsEndpointURL, normalizeEnv(sdkID))); endpt != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #40e8ce533807e95d — Environment-variable access.
pkgs/go/[email protected]/env_config.go:664 
		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #927a3c3b3ac9269b — Environment-variable access.
pkgs/go/[email protected]/env_config.go:673 
		if v := os.Getenv(k); len(v) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f543a595849d232 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:688 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4986c3623f6846f6 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:715 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c18ab6941369eeb4 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:739 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94f008c0819650e2 — Environment-variable access.
pkgs/go/[email protected]/env_config.go:762 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6572d9c28f1909c — Environment-variable access.
pkgs/go/[email protected]/env_config.go:783 
		value := os.Getenv(k)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70fd7756e64b6890 — Environment-variable access.
pkgs/go/[email protected]/resolve_credentials.go:312 
			if authFilePath := os.Getenv(httpProviderAuthFileEnvVar); authFilePath != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb233411c8725d56 — Filesystem access.
pkgs/go/[email protected]/resolve_credentials.go:316 
					if contents, err = ioutil.ReadFile(authFilePath); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51d6ab8a7ff1e1ff — Filesystem access.
pkgs/go/[email protected]/shared_config.go:484 
	b, err := ioutil.ReadFile(c.CustomCABundle)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/credentials

go dependency
expand_more 4 low-confidence finding(s)
low env_fs dependency Excluded from app score #20d37beb2daa3f43 — Environment-variable access.
pkgs/go/[email protected]/processcreds/provider.go:104 
	cmd.Env = os.Environ()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2fe61a67d69e5067 — Filesystem access.
pkgs/go/[email protected]/ssocreds/sso_cached_token.go:148 
	fileBytes, err := ioutil.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #311a84d0384cd0e6 — Filesystem access.
pkgs/go/[email protected]/ssocreds/sso_cached_token.go:181 
	f, err = os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_RDWR, fileMode)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78fdda4a524d8c67 — Filesystem access.
pkgs/go/[email protected]/stscreds/web_identity_provider.go:79 
	b, err := ioutil.ReadFile(string(j))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/aws/aws-sdk-go-v2/service/s3

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #95f31d88e2da666f — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:219 
	_, g := os.LookupEnv("AWS_ENDPOINT_URL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e7b812cd7c3ef53 — Environment-variable access.
pkgs/go/[email protected]/endpoints.go:220 
	_, s := os.LookupEnv("AWS_ENDPOINT_URL_S3")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/docker/go-connections

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #ac316523278428b4 — Environment-variable access.
pkgs/go/[email protected]/sockets/proxy.go:13 
	proxyValue := os.Getenv(strings.ToUpper(key))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47718c23a6aafc22 — Environment-variable access.
pkgs/go/[email protected]/sockets/proxy.go:15 
		return os.Getenv(strings.ToLower(key))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #389088899cf5a994 — Filesystem access.
pkgs/go/[email protected]/tlsconfig/config.go:106 
	pemData, err := os.ReadFile(caFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a838bae1abe61e4b — Filesystem access.
pkgs/go/[email protected]/tlsconfig/config.go:188 
	cert, err := os.ReadFile(options.CertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2c31e2d9da56966 — Filesystem access.
pkgs/go/[email protected]/tlsconfig/config.go:193 
	prKeyBytes, err := os.ReadFile(options.KeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/jackc/pgx/v5

go dependency
expand_more 11 low-confidence finding(s)
low env_fs tooling Excluded from app score unreachable #2871768e31f93b93 — Environment-variable access.
pkgs/go/[email protected]/examples/chat/main.go:16 
	pool, err = pgxpool.New(context.Background(), os.Getenv("DATABASE_URL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a15420728434cf17 — Environment-variable access.
pkgs/go/[email protected]/examples/todo/main.go:16 
	conn, err = pgx.Connect(context.Background(), os.Getenv("DATABASE_URL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #664b192f09587aac — Environment-variable access.
pkgs/go/[email protected]/examples/url_shortener/main.go:73 
	poolConfig, err := pgxpool.ParseConfig(os.Getenv("DATABASE_URL"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #276e71f03a703d78 — Environment-variable access.
pkgs/go/[email protected]/pgconn/config.go:441 
		value := os.Getenv(envname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8ea1dfbe3fb2b19e — Filesystem access.
pkgs/go/[email protected]/pgconn/config.go:701 
		caCert, err := os.ReadFile(caPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #613d9b6654aa540b — Filesystem access.
pkgs/go/[email protected]/pgconn/config.go:719 
		buf, err := os.ReadFile(sslkey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9371de2e0197f3c7 — Filesystem access.
pkgs/go/[email protected]/pgconn/config.go:761 
		certfile, err := os.ReadFile(sslcert)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9120d0bf2aad8fe3 — Environment-variable access.
pkgs/go/[email protected]/pgconn/defaults_windows.go:20 
	appData := os.Getenv("APPDATA")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c96b1613d4bf4d8 — Filesystem access.
pkgs/go/[email protected]/testsetup/generate_certs.go:121 
	file, err := os.Create(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c46c8c729c6cc7dc — Filesystem access.
pkgs/go/[email protected]/testsetup/generate_certs.go:143 
	file, err := os.Create(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #950199b3dfa90ae9 — Filesystem access.
pkgs/go/[email protected]/testsetup/generate_certs.go:168 
	file, err := os.Create(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/lib/pq

go dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #a35f7ebce5481de3 — Environment-variable access.
pkgs/go/[email protected]/conn.go:236 
	filename := os.Getenv("PGPASSFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #907b01730a235553 — Environment-variable access.
pkgs/go/[email protected]/conn.go:241 
		userHome := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a8a2768b44a6e25 — Filesystem access.
pkgs/go/[email protected]/conn.go:260 
	file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #83d9f68d51c1be12 — Environment-variable access.
pkgs/go/[email protected]/connector.go:61 
	for k, v := range parseEnviron(os.Environ()) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06adb282261ba87b — Environment-variable access.
pkgs/go/[email protected]/oid/gen.go:31 
	datname := os.Getenv("PGDATABASE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d901b64da239a80 — Environment-variable access.
pkgs/go/[email protected]/oid/gen.go:32 
	sslmode := os.Getenv("PGSSLMODE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9846d7defb5262bd — Filesystem access.
pkgs/go/[email protected]/oid/gen.go:71 
	f, err := os.Create("types.go")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b7a3b529e768d44 — Filesystem access.
pkgs/go/[email protected]/ssl.go:168 
			cert, err = ioutil.ReadFile(sslrootcert)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a230cc7a6d1f8edb — Environment-variable access.
pkgs/go/[email protected]/user_posix.go:19 
	name := os.Getenv("USER")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/rs/zerolog

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #1b430d98342d9b2e — Environment-variable access.
pkgs/go/[email protected]/console.go:315 
	e := os.Getenv("NO_COLOR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7afee5da547cc7d1 — Filesystem access.
pkgs/go/[email protected]/internal/cbor/examples/genLog.go:17 
		fil, _ := os.Create(fname)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/spf13/cobra

go dependency
expand_more 14 low-confidence finding(s)
low env_fs dependency Excluded from app score #8fdef8a7305c943e — Environment-variable access.
pkgs/go/[email protected]/active_help.go:49 
	activeHelpCfg := os.Getenv(activeHelpGlobalEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad5502ef19823d04 — Environment-variable access.
pkgs/go/[email protected]/active_help.go:51 
		activeHelpCfg = os.Getenv(activeHelpEnvVar(cmd.Root().Name()))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e1ab5e70697c94e — Filesystem access.
pkgs/go/[email protected]/bash_completions.go:705 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1c23519896d8f245 — Filesystem access.
pkgs/go/[email protected]/bash_completionsV2.go:383 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54427505de545d53 — Environment-variable access.
pkgs/go/[email protected]/completions.go:846 
	if path := os.Getenv("BASH_COMP_DEBUG_FILE"); path != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8595737cc72a43ff — Filesystem access.
pkgs/go/[email protected]/completions.go:847 
		f, err := os.OpenFile(path,
			os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d05914f60866424 — Filesystem access.
pkgs/go/[email protected]/doc/man_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #635c9d59c082898d — Environment-variable access.
pkgs/go/[email protected]/doc/man_docs.go:127 
		if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ddf83329de653dc8 — Filesystem access.
pkgs/go/[email protected]/doc/md_docs.go:143 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb8cdd2dbb3aad58 — Filesystem access.
pkgs/go/[email protected]/doc/rest_docs.go:157 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #829d00127d3d0474 — Filesystem access.
pkgs/go/[email protected]/doc/yaml_docs.go:72 
	f, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96d08581af78f0ce — Filesystem access.
pkgs/go/[email protected]/fish_completions.go:285 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf180ca13e9e6b16 — Filesystem access.
pkgs/go/[email protected]/powershell_completions.go:296 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a72ab5c25163f80 — Filesystem access.
pkgs/go/[email protected]/zsh_completions.go:71 
	outFile, err := os.Create(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

github.com/testcontainers/testcontainers-go

go dependency
expand_more 17 low-confidence finding(s)
low env_fs dependency Excluded from app score #6aac08c0745f13f7 — Filesystem access.
pkgs/go/[email protected]/container.go:233 
	if f, openErr := os.Open(fileLocation); openErr == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3fdcee939a0dbe84 — Filesystem access.
pkgs/go/[email protected]/docker.go:605 
	fileContent, err := os.ReadFile(hostFilePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f348e9e389e14f54 — Environment-variable access.
pkgs/go/[email protected]/docker.go:1317 
	host, exists := os.LookupEnv("TC_HOST")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8709775fd901b4be — Filesystem access.
pkgs/go/[email protected]/docker.go:1565 
	outputFile, err := os.Create(output)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #897b999cc93fc872 — Environment-variable access.
pkgs/go/[email protected]/docker_auth.go:125 
	dockerAuthConfig := os.Getenv("DOCKER_AUTH_CONFIG")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #216e5fff2dba3077 — Filesystem access.
pkgs/go/[email protected]/file.go:15 
	file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f52d49ebd8f6c64 — Filesystem access.
pkgs/go/[email protected]/file.go:85 
			data, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5627408d2a582c68 — Environment-variable access.
pkgs/go/[email protected]/internal/config/config.go:70 
		ryukDisabledEnv := os.Getenv("TESTCONTAINERS_RYUK_DISABLED")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae93d98e1ed82242 — Environment-variable access.
pkgs/go/[email protected]/internal/config/config.go:75 
		hubImageNamePrefix := os.Getenv("TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #28c8887e05a5fdbc — Environment-variable access.
pkgs/go/[email protected]/internal/config/config.go:80 
		ryukPrivilegedEnv := os.Getenv("TESTCONTAINERS_RYUK_CONTAINER_PRIVILEGED")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #51dbba64f88d864f — Environment-variable access.
pkgs/go/[email protected]/internal/config/config.go:85 
		ryukVerboseEnv := os.Getenv("TESTCONTAINERS_RYUK_VERBOSE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #80b271a52bd96b53 — Environment-variable access.
pkgs/go/[email protected]/internal/core/docker_host.go:189 
	if dockerHostPath := os.Getenv("DOCKER_HOST"); dockerHostPath != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e457100d2cadf41 — Environment-variable access.
pkgs/go/[email protected]/internal/core/docker_host.go:224 
	if dockerHostPath, exists := os.LookupEnv("TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE"); exists {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cbffa6e4813cb6c2 — Environment-variable access.
pkgs/go/[email protected]/internal/core/docker_rootless.go:29 
	return os.Getenv("GOOS") == "windows" || runtime.GOOS == "windows"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #176364e5bd05cc77 — Environment-variable access.
pkgs/go/[email protected]/internal/core/docker_rootless.go:97 
	xdgRuntimeDir, exists := os.LookupEnv("XDG_RUNTIME_DIR")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c99ad3471a3bd0d7 — Filesystem access.
pkgs/go/[email protected]/internal/core/images.go:31 
	file, err := os.Open(dockerfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5dba07a948420786 — Environment-variable access.
pkgs/go/[email protected]/provider.go:106 
	if pt == ProviderDefault && strings.Contains(os.Getenv("DOCKER_HOST"), "podman.sock") {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #d0310baff3571b67 — Filesystem access.
pkgs/go/go.opentelemetry.io_otel_exporters_otlp_otlpmetric_otlpmetricgrpc@v1.28.0/internal/oconf/tls.go:19 
	b, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/sdk

go dependency
expand_more 11 low-confidence finding(s)
low env_fs dependency Excluded from app score #4ee5b300d1812ac3 — Environment-variable access.
pkgs/go/[email protected]/internal/env/env.go:62 
		value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #114eb3c0ab95d5f9 — Environment-variable access.
pkgs/go/[email protected]/internal/env/env.go:82 
	value := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06139a1b1c54b679 — Environment-variable access.
pkgs/go/[email protected]/internal/internaltest/env.go:64 
	originValue, exists := os.LookupEnv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90ae23a5e5cc3c24 — Environment-variable access.
pkgs/go/[email protected]/internal/x/x.go:55 
	vRaw := os.Getenv(f.key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b41ea47d932f1e9b — Filesystem access.
pkgs/go/[email protected]/resource/container.go:47 
		return os.Open(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50c50aa5892527ca — Environment-variable access.
pkgs/go/[email protected]/resource/env.go:39 
	attrs := strings.TrimSpace(os.Getenv(resourceAttrKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f94e46d04643492 — Environment-variable access.
pkgs/go/[email protected]/resource/env.go:40 
	svcName := strings.TrimSpace(os.Getenv(svcNameKey))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #327e4e83b53de060 — Filesystem access.
pkgs/go/[email protected]/resource/host_id_readfile.go:11 
	b, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #484e931c58a223ef — Filesystem access.
pkgs/go/[email protected]/resource/os_unix.go:72 
		file, err := os.Open(c)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b185a088210b183 — Environment-variable access.
pkgs/go/[email protected]/trace/sampler_env.go:50 
	sampler, ok := os.LookupEnv(tracesSamplerKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b7972184a92ec428 — Environment-variable access.
pkgs/go/[email protected]/trace/sampler_env.go:56 
	samplerArg, hasSamplerArg := os.LookupEnv(tracesSamplerArgKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/sdk/metric

go dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #2a14d81ad3294c60 — Environment-variable access.
pkgs/go/[email protected]/env.go:25 
	v := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9a49cdc6d7cbde64 — Environment-variable access.
pkgs/go/[email protected]/exemplar.go:31 
	switch os.Getenv(filterEnvKey) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3858671e250c22ca — Environment-variable access.
pkgs/go/[email protected]/internal/x/x.go:74 
	vRaw := os.Getenv(f.key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.opentelemetry.io/otel/trace

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #a89552766cebb832 — Environment-variable access.
pkgs/go/[email protected]/auto.go:649 
		strV := os.Getenv(key)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.uber.org/automaxprocs

go dependency
expand_more 5 low-confidence finding(s)
low env_fs dependency Excluded from app score #6908bd4ca1b48213 — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/cgroup.go:56 
	paramFile, err := os.Open(cg.ParamPath(param))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad47109cfd5b59b3 — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/cgroups2.go:129 
	cpuMaxParams, err := os.Open(path.Join(cg.mountPoint, cg.groupPath, cg.cpuMaxFile))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8c6220e26d45d99 — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/mountpoint.go:152 
	mountInfoFile, err := os.Open(procPathMountInfo)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bb77300f09bd8b5d — Filesystem access.
pkgs/go/[email protected]/internal/cgroups/subsys.go:79 
	cgroupFile, err := os.Open(procPathCGroup)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6408afe273822c27 — Environment-variable access.
pkgs/go/[email protected]/maxprocs/maxprocs.go:100 
	if max, exists := os.LookupEnv(_maxProcsKey); exists {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

go.uber.org/zap

go dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #e6c090505fc5696b — Environment-variable access.
pkgs/go/[email protected]/internal/ztest/timeout.go:55 
	if v := os.Getenv("TEST_TIMEOUT_SCALE"); v != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

google.golang.org/grpc

go dependency
expand_more 42 low-confidence finding(s)
low env_fs dependency Excluded from app score #0a052ced8a4b16f4 — Filesystem access.
pkgs/go/[email protected]/authz/grpc_authz_server_interceptors.go:143 
	policyContents, err := os.ReadFile(i.policyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0ab3795febcd7018 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:939 
		f, err := os.Create(opts.cpuProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7a7eca62b3d196e7 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:957 
		f, err := os.Create(opts.memProfile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #bf49fa6c29a4cb75 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchmain/main.go:970 
		f, err := os.Create(opts.benchmarkResultFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #850e81a1b0e85501 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchresult/main.go:44 
	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #2f11ebc6ee6a5380 — Filesystem access.
pkgs/go/[email protected]/benchmark/benchresult/main.go:117 
	f, err := os.Open(fileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #aa4b9d7cb64b2ef2 — Filesystem access.
pkgs/go/[email protected]/benchmark/client/main.go:104 
	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #d32ac6072b74f20e — Filesystem access.
pkgs/go/[email protected]/benchmark/client/main.go:117 
	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #69dadacdea179977 — Filesystem access.
pkgs/go/[email protected]/benchmark/server/main.go:66 
	cf, err := os.Create("/tmp/" + *testName + ".cpu")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a7d375ed15e8bc3b — Filesystem access.
pkgs/go/[email protected]/benchmark/server/main.go:85 
	mf, err := os.Create("/tmp/" + *testName + ".mem")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #67dc823d62a418f2 — Filesystem access.
pkgs/go/[email protected]/benchmark/stats/curve.go:83 
	data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #865ae8c586d8d36c — Filesystem access.
pkgs/go/[email protected]/benchmark/stats/curve.go:104 
	f, err := os.Open(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f98d70dc878435f1 — Filesystem access.
pkgs/go/[email protected]/credentials/oauth/oauth.go:76 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0050e25feca4979 — Filesystem access.
pkgs/go/[email protected]/credentials/oauth/oauth.go:195 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb07d592c6ecc28b — Filesystem access.
pkgs/go/[email protected]/credentials/tls.go:245 
	b, err := os.ReadFile(certFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #89a889dceeff9506 — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:157 
	certFileContents, err := os.ReadFile(w.opts.CertFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9dcaa4b234f39134 — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:162 
	keyFileContents, err := os.ReadFile(w.opts.KeyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #140ce30e8ca0f5b0 — Filesystem access.
pkgs/go/[email protected]/credentials/tls/certprovider/pemfile/watcher.go:194 
	rootFileContents, err := os.ReadFile(w.opts.RootFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e677a6d5125f81e — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:146 
	logLevel := os.Getenv("GRPC_GO_LOG_SEVERITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #63fbe6ea8427c3c2 — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:157 
	vLevel := os.Getenv("GRPC_GO_LOG_VERBOSITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2623572e0b527037 — Environment-variable access.
pkgs/go/[email protected]/grpclog/loggerv2.go:162 
	jsonFormat := strings.EqualFold(os.Getenv("GRPC_GO_LOG_FORMATTER"), "json")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e4112cad67c3360 — Environment-variable access.
pkgs/go/[email protected]/internal/binarylog/binarylog.go:77 
	configStr := os.Getenv(envStr)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b341c65cfeaf4251 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:54 
		return !strings.EqualFold(os.Getenv(envVar), "false")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f0bc1e0ee0c70a69 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:57 
	return strings.EqualFold(os.Getenv(envVar), "true")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a208b2de09f85a04 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/envconfig.go:61 
	v, err := strconv.ParseUint(os.Getenv(envVar), 10, 64)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08af8916eaaf02da — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/observability.go:34 
	ObservabilityConfig = os.Getenv(envObservabilityConfig)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb102696d535fd78 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/observability.go:41 
	ObservabilityConfigFile = os.Getenv(envObservabilityConfigFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e1435126c082fd6b — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:46 
	XDSBootstrapFileName = os.Getenv(XDSBootstrapFileNameEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7424ee5d3e97d42c — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:52 
	XDSBootstrapFileContent = os.Getenv(XDSBootstrapFileContentEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #84a8d31123472f98 — Environment-variable access.
pkgs/go/[email protected]/internal/envconfig/xds.go:55 
	C2PResolverTestOnlyTrafficDirectorURI = os.Getenv("GRPC_TEST_ONLY_GOOGLE_C2P_RESOLVER_TRAFFIC_DIRECTOR_URI")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6f9258d790bb917 — Filesystem access.
pkgs/go/[email protected]/internal/googlecloud/manufacturer_linux.go:26 
	return os.ReadFile(linuxProductNameFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c6ca996239a1218 — Environment-variable access.
pkgs/go/[email protected]/internal/grpctest/tlogger.go:77 
	vLevel := os.Getenv("GRPC_GO_LOG_VERBOSITY_LEVEL")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77c55860afb3f72a — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/bootstrap/bootstrap.go:84 
	if err := os.WriteFile(f.Name(), bootstrapContents, 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4cb1b44b457acdd2 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/setup_certs.go:41 
	data, err := os.ReadFile(src)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26a49b9991de2624 — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/setup_certs.go:45 
	if err := os.WriteFile(dst, data, os.ModePerm); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71b9bb40a6605d5f — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/setup_certs.go:84 
	b, err := os.ReadFile(testdata.Path("x509/server_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4930bcf1ef8a4ecb — Filesystem access.
pkgs/go/[email protected]/internal/testutils/xds/e2e/setup_certs.go:108 
	b, err := os.ReadFile(testdata.Path("x509/client_ca_cert.pem"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b83ae2efd50105d5 — Filesystem access.
pkgs/go/[email protected]/interop/client/client.go:199 
			b, err := os.ReadFile(*caFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #246658e95d324283 — Filesystem access.
pkgs/go/[email protected]/interop/test_utils.go:288 
	jsonKey, err := os.ReadFile(keyFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1517c8d43f4788a — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/catapult.go:378 
	streamStatsCatapultJSONFile, err := os.Create(streamStatsCatapultJSONFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1d64ce8c7ba0b617 — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/local.go:29 
	snapshotFile, err := os.Open(snapshotFileName)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc3ccee77c81063d — Filesystem access.
pkgs/go/[email protected]/profiling/cmd/remote.go:54 
	file, err := os.Create(f)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

k8s.io/apimachinery

go dependency
expand_more 16 low-confidence finding(s)
low env_fs dependency Excluded from app score #be1c32fb3572286c — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/codec.go:73 
	if apiMediaType := os.Getenv("KUBE_TEST_API_TYPE"); len(apiMediaType) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9518062a6fe3b6fb — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/codec.go:80 
	if storageMediaType := os.Getenv("KUBE_TEST_API_STORAGE_TYPE"); len(storageMediaType) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7ef0311e9f524a4 — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:268 
		if os.Getenv(updateEnvVar) == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfdbec1c885b3fb3 — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:336 
	actualJSON, jsonErr := ioutil.ReadFile(filepath.Join(dir, jsonFilename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2d59f872abd0fc1e — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:338 
	actualYAML, yamlErr := ioutil.ReadFile(filepath.Join(dir, yamlFilename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41b6d7e040ee9cf1 — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:340 
	actualProto, protoErr := ioutil.ReadFile(filepath.Join(dir, protoFilename))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85f1ec76173b832b — Filesystem access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:362 
	if err := ioutil.WriteFile(filepath.Join(dir, makeName(gvk)+suffix+"."+extension), data, os.FileMode(0644)); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93d1db973ec0a01f — Environment-variable access.
pkgs/go/[email protected]/pkg/api/apitesting/roundtrip/compatibility.go:480 
		if os.Getenv(updateEnvVar) == "true" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e73b369ed4be8459 — Environment-variable access.
pkgs/go/[email protected]/pkg/runtime/converter.go:78 
		mismatchDetection: parseBool(os.Getenv("KUBE_PATCH_CONVERSION_DETECTOR")),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b2ba8a32b787c59 — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:134 
	if s := os.Getenv("DISABLE_HTTP2"); len(s) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5316750f40df2ffc — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:148 
	if s := os.Getenv("HTTP2_READ_IDLE_TIMEOUT_SECONDS"); len(s) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #afe4acd5eb1e3dca — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:162 
	if s := os.Getenv("HTTP2_PING_TIMEOUT_SECONDS"); len(s) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07b785307b8cdb7b — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:400 
	noProxyEnv := os.Getenv("NO_PROXY")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #394615fde6265953 — Environment-variable access.
pkgs/go/[email protected]/pkg/util/net/http.go:402 
		noProxyEnv = os.Getenv("no_proxy")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64e6dddd0ea23960 — Filesystem access.
pkgs/go/[email protected]/pkg/util/net/interface.go:97 
	file, err := os.Open(rf.name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d6bc88d7d1b9afb — Filesystem access.
pkgs/go/[email protected]/pkg/util/strategicpatch/testing/openapi.go:45 
		spec, err := os.ReadFile(f.Path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

k8s.io/client-go

go dependency
expand_more 50 low-confidence finding(s)
low env_fs dependency Excluded from app score #7c444d92bce56341 — Filesystem access.
pkgs/go/[email protected]/discovery/cached/disk/cached_discovery.go:145 
	file, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0a71c5b484ce66d6 — Environment-variable access.
pkgs/go/[email protected]/rest/client.go:142 
	backoffBase := os.Getenv(envBackoffBase)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eddfa3dc0d06e215 — Environment-variable access.
pkgs/go/[email protected]/rest/client.go:143 
	backoffDuration := os.Getenv(envBackoffDuration)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d084bdb61be282f — Environment-variable access.
pkgs/go/[email protected]/rest/config.go:516 
	host, port := os.Getenv("KUBERNETES_SERVICE_HOST"), os.Getenv("KUBERNETES_SERVICE_PORT")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f26c7852502ba9c3 — Filesystem access.
pkgs/go/[email protected]/rest/config.go:521 
	token, err := os.ReadFile(tokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #91ef7ab19ac7f052 — Filesystem access.
pkgs/go/[email protected]/rest/config.go:584 
		fileData, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #50188edb14ce0642 — Filesystem access.
pkgs/go/[email protected]/rest/request.go:445 
		data, err := os.ReadFile(t)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #a0cbe524d6107f36 — Filesystem access.
pkgs/go/[email protected]/tools/auth/clientauth.go:92 
	data, err := os.ReadFile(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e9e463a5da03378c — Environment-variable access.
pkgs/go/[email protected]/tools/auth/exec/exec.go:48 
	env := os.Getenv(execInfoEnv)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #3cce7af7bb33ff41 — Environment-variable access.
pkgs/go/[email protected]/tools/cache/mutation_detector.go:36 
	mutationDetectionEnabled, _ = strconv.ParseBool(os.Getenv("KUBE_CACHE_MUTATION_DETECTOR"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #8b907da3cd04d767 — Environment-variable access.
pkgs/go/[email protected]/tools/cache/reflector.go:240 
	if s := os.Getenv("ENABLE_CLIENT_GO_WATCH_LIST_ALPHA"); len(s) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #b02b8fcd12e7b8b1 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/api/helpers.go:156 
		*contents, err = os.ReadFile(absPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0b82393f52650f99 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/auth_loaders.go:61 
		err = os.WriteFile(path, data, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9ed76e618dd4bb41 — Environment-variable access.
pkgs/go/[email protected]/tools/clientcmd/client_config.go:55 
	if server := os.Getenv("KUBERNETES_MASTER"); len(server) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #acf71e0268dd3df1 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/client_config.go:250 
		tokenBytes, err := os.ReadFile(configAuthInfo.TokenFile)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #272fd3de32890066 — Environment-variable access.
pkgs/go/[email protected]/tools/clientcmd/client_config.go:585 
	if ns := os.Getenv("POD_NAMESPACE"); ns != "" {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e6abd979ab91e732 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/client_config.go:590 
	if data, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/namespace"); err == nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #0054e5cf0868b281 — Environment-variable access.
pkgs/go/[email protected]/tools/clientcmd/client_config.go:606 
	return os.Getenv("KUBERNETES_SERVICE_HOST") != "" &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #aeeaad906fc97528 — Environment-variable access.
pkgs/go/[email protected]/tools/clientcmd/client_config.go:607 
		os.Getenv("KUBERNETES_SERVICE_PORT") != "" &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #6f9a27d1c3a8e049 — Environment-variable access.
pkgs/go/[email protected]/tools/clientcmd/config.go:75 
	envVarValue := os.Getenv(o.EnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #37619ccdb40c2896 — Environment-variable access.
pkgs/go/[email protected]/tools/clientcmd/loader.go:64 
		RecommendedHomeFile: filepath.Join(os.Getenv("HOME"), RecommendedHomeDir, oldRecommendedHomeFileName),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #9cf2ff4e473dbe87 — Environment-variable access.
pkgs/go/[email protected]/tools/clientcmd/loader.go:164 
	envVarFiles := os.Getenv(RecommendedConfigPathEnvVar)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #756e8c00af5357c6 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/loader.go:307 
		data, err := os.ReadFile(source)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #5a1f959884c31ca9 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/loader.go:312 
		err = os.WriteFile(destination, data, 0666)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #7fe16c5484ee4a15 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/loader.go:387 
	kubeconfigBytes, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #203f5c808bd2819c — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/loader.go:453 
	if err := os.WriteFile(filename, content, 0600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #efcd90bf4e5f18fd — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/loader.go:470 
	f, err := os.OpenFile(lockName(filename), os.O_CREATE|os.O_EXCL, 0)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #579cc27ed92227f8 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/validation.go:251 
		clientCertCA, err := os.Open(clusterInfo.CertificateAuthority)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #e06eb027c77bb66a — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/validation.go:290 
			clientCertFile, err := os.Open(authInfo.ClientCertificate)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unreachable #30b66019e5c8d022 — Filesystem access.
pkgs/go/[email protected]/tools/clientcmd/validation.go:298 
			clientKeyFile, err := os.Open(authInfo.ClientKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7e1b7cd64e50fb71 — Filesystem access.
pkgs/go/[email protected]/transport/token_source.go:135 
	tokb, err := os.ReadFile(ts.path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1aa72ef35f345929 — Filesystem access.
pkgs/go/[email protected]/transport/transport.go:186 
		fileData, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4397502d276f8ca8 — Filesystem access.
pkgs/go/[email protected]/util/cert/cert.go:116 
		cert, err := os.ReadFile(certFixturePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7db2dd0effc38ac7 — Filesystem access.
pkgs/go/[email protected]/util/cert/cert.go:118 
			key, err := os.ReadFile(keyFixturePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9f5c2e515128a97 — Filesystem access.
pkgs/go/[email protected]/util/cert/cert.go:213 
		if err := os.WriteFile(certFixturePath, certBuffer.Bytes(), 0644); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fc5059d49569dea — Filesystem access.
pkgs/go/[email protected]/util/cert/cert.go:216 
		if err := os.WriteFile(keyFixturePath, keyBuffer.Bytes(), 0600); err != nil {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8dcff53eeccd1439 — Filesystem access.
pkgs/go/[email protected]/util/cert/io.go:50 
	f, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cc607615036b4422 — Filesystem access.
pkgs/go/[email protected]/util/cert/io.go:68 
	return os.WriteFile(certPath, data, os.FileMode(0644))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #739114a9b98c76c9 — Filesystem access.
pkgs/go/[email protected]/util/cert/io.go:74 
	pemBlock, err := os.ReadFile(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70ef2aaf9d7f51a1 — Filesystem access.
pkgs/go/[email protected]/util/cert/io.go:103 
	pemBlock, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43d6573ed198575a — Filesystem access.
pkgs/go/[email protected]/util/certificate/certificate_store.go:196 
	f, err := os.OpenFile(certPath, os.O_CREATE|os.O_TRUNC|os.O_RDWR, 0600)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32474cac5d6245a3 — Environment-variable access.
pkgs/go/[email protected]/util/homedir/homedir.go:33 
		home := os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2e8a6f3ba222345d — Environment-variable access.
pkgs/go/[email protected]/util/homedir/homedir.go:35 
		if homeDrive, homePath := os.Getenv("HOMEDRIVE"), os.Getenv("HOMEPATH"); len(homeDrive) > 0 && len(homePath) > 0 {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fad03c9793b38f2e — Environment-variable access.
pkgs/go/[email protected]/util/homedir/homedir.go:38 
		userProfile := os.Getenv("USERPROFILE")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e15645768732bcab — Environment-variable access.
pkgs/go/[email protected]/util/homedir/homedir.go:91 
	return os.Getenv("HOME")

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fb140c2b76a2780e — Filesystem access.
pkgs/go/[email protected]/util/keyutil/key.go:71 
	return os.WriteFile(keyPath, data, os.FileMode(0600))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbff8f0c76b63eee — Filesystem access.
pkgs/go/[email protected]/util/keyutil/key.go:77 
	loadedData, err := os.ReadFile(keyPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37b325280a8dcc17 — Filesystem access.
pkgs/go/[email protected]/util/keyutil/key.go:124 
	data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dce946b93304c87a — Filesystem access.
pkgs/go/[email protected]/util/keyutil/key.go:138 
	data, err := os.ReadFile(file)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da81f326516def0b — Filesystem access.
pkgs/go/[email protected]/util/testing/fake_openapi_handler.go:63 
		file, err := os.Open(path)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pgregory.net/rapid

go dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #1f5de38c06082b89 — Filesystem access.
pkgs/go/[email protected]/persist.go:94 
	f, err := os.Open(filename)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e59116d895a2f349 — Filesystem access.
pkgs/go/[email protected]/shrink.go:51 
		f, err := os.Create(name)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • onnxruntime prod — no sdist (wheels only)
  • matplotlib prod — sdist exceeds byte cap
  • dotenv prod — no sdist (wheels only)