Close Open Privacy Scan
App Privacy Score
Low risk · 54 finding(s)
Dependency score: 97 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz External domains
accounts.feishu.cnaccounts.larksuite.comai.google.devaiplatform.googleapis.comaistudio.google.comaka.msapi-docs.deepseek.comapi-inference.modelscope.cnapi.anthropic.comapi.deepseek.comapi.dingtalk.comapi.github.comapi.minimax.ioapi.minimaxi.comapi.openai.comapi.sgroup.qq.comapi.telegram.orgapi.x.aiapi.z.aiautopush-generativelanguage.sandbox.googleapis.combailian.console.aliyun.combots.qq.comcatfact.ninjacdn.jsdelivr.netcdnjs.cloudflare.comchat.qwen.aiclaudemarketplaces.comcloud.google.comcn-hongkong.dashscope.aliyuncs.comcode.visualstudio.comcodeassist.google.comcodeload.github.comcoding-intl.dashscope.aliyuncs.comcoding.dashscope.aliyuncs.comdashscope-intl.aliyuncs.comdashscope-us.aliyuncs.comdashscope.aliyuncs.comdevelopers.google.comdocs.anthropic.comdocs.expo.devdocs.fireworks.aidocs.github.comdocs.python.orgdocs.requesty.aidocs.x.aidocs.z.aiduckduckgo.comdummy.comemscripten.orgfonts.googleapis.comfonts.gstatic.comgb4w8c3ygj-default-sea.rum.aliyuncs.comgemini-api-demos.uc.r.appspot.comgeminicli.comgenerativelanguage.googleapis.comgit-scm.comgithub.comgoo.glegrafana.comhelp.aliyun.comhelp.openai.comhost.comiamcredentials.googleapis.comidealab.alibaba-inc.comilinkai.weixin.qq.comjson-schema.orglogback.qos.chmarketplace.visualstudio.commodelscope.cnmodelstudio.console.alibabacloud.comnewrelic.comnews.google.comnews.ycombinator.comnovac2c.cdn.weixin.qq.comnpm.imoapi.dingtalk.comontheline.trincoll.eduopen.feishu.cnopen.larksuite.comopenrouter.aiplatform.claude.complatform.minimaxi.complatform.openai.complay.googleapis.compolicies.google.comqwen-code-assets.oss-cn-hangzhou.aliyuncs.comqwenlm.github.ioraw.githubusercontent.comreact.devregistry.npmjs.orgrouter.requesty.aisandbox.api.sgroup.qq.comsindresorhus.comstorage.googleapis.comt.metelegram.metoken-plan.ap-southeast-1.maas.aliyuncs.comtoken-plan.cn-beijing.maas.aliyuncs.comunpkg.comus.i.posthog.comvia.placeholder.comwww.alibabacloud.comwww.allrecipes.comwww.booking.comwww.cloudflarestatus.comwww.cms.govwww.datadoghq.comwww.figma.comwww.foodnetwork.comwww.githubstatus.comwww.googleapis.comwww.gov.ukwww.kaggle.comwww.minimax.iowww.producthunt.comwww.slf4j.orgwww.typescriptlang.orgwww.w3.orgwww.youtube.comyour-server.com
</> First-Party Code
first-party (java): packages/sdk-java/client
java first-partyexpand_more 2 low-confidence finding(s)
private String cwd = System.getProperty("user.dir");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (BufferedReader br = new BufferedReader(new InputStreamReader(Files.newInputStream(file.toPath()), charset), 16384)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): packages/sdk-java/qwencode
java first-partyexpand_more 1 low-confidence finding(s)
Map<String, String> env = new HashMap<>(System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
</> Dependencies
ch.qos.logback:logback-classic
java dependencyexpand_more 1 low-confidence finding(s)
return System.getProperty(key);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
com.alibaba.fastjson2:fastjson2
java dependencyexpand_more 23 low-confidence finding(s)
String property = System.getProperty("fastjson2.creator");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String features = System.getProperty("fastjson2.features");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(name);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(name);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_DENY_PROPERTY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_AUTO_TYPE_ACCEPT);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_AUTO_TYPE_BEFORE_HANDLER);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(PROPERTY_AUTO_TYPE_HANDLER);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty("fastjson.parser.safeMode");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
property = System.getProperty("fastjson2.parser.safeMode");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return of(Files.newInputStream(file.toPath()), StandardCharsets.UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), StandardCharsets.UTF_8, types);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, consumer);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF16(new InputStreamReader(Files.newInputStream(file.toPath()), charset), consumer);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
new InputStreamReader(Files.newInputStream(file.toPath()), charset), typesReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, types);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.newInputStream(file.toPath()),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new CSVReaderUTF8(Files.newInputStream(file.toPath()), charset, objectClass);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream in = new FileInputStream(file)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream in = new FileInputStream(file)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String jmvName = System.getProperty("java.vm.name");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
graal = System.getProperty("org.graalvm.nativeimage.imagecode") != null;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String javaSpecVer = System.getProperty("java.specification.version");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
commons-io:commons-io
java dependencyexpand_more 19 low-confidence finding(s)
return System.getProperty(property);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream inputStream = new CheckedInputStream(Files.newInputStream(file.toPath()), checksum)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (Reader input1 = new InputStreamReader(Files.newInputStream(file1.toPath()), charset);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Reader input2 = new InputStreamReader(Files.newInputStream(file2.toPath()), charset)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream fis = Files.newInputStream(input.toPath())) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty("java.io.tmpdir");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty("user.home");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
inputStream = Files.newInputStream(file.toPath());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new FileInputStream(file);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.readAllBytes(file.toPath());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return IOUtils.toString(() -> Files.newInputStream(file.toPath()), Charsets.toCharset(charsetName));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.readAllLines(file.toPath(), Charsets.toCharset(charset));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream inputStream1 = Files.newInputStream(nPath1, openOptions);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
InputStream inputStream2 = Files.newInputStream(nPath2, openOptions)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final String property = key != null && !key.isEmpty() ? System.getProperty(key, defaultPath) : defaultPath;Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new String(Files.readAllBytes(path), Charsets.toCharset(charset));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(path, String.valueOf(charSequence).getBytes(Charsets.toCharset(charset)), openOptions);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
this(Files.newInputStream(Objects.requireNonNull(file, "file")));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.newInputStream(outputPath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
org.apache.commons:commons-lang3
java dependencyexpand_more 4 low-confidence finding(s)
final byte[] bytes = Files.readAllBytes(Paths.get(envVarFile));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return StringUtils.getIfEmpty(System.getProperty(property), defaultIfAbsent);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final String value = System.getenv(name);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return IS_OS_WINDOWS ? System.getenv("COMPUTERNAME") : System.getenv("HOSTNAME");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
org.slf4j:slf4j-api
java dependencyexpand_more 4 low-confidence finding(s)
String explicitlySpecified = System.getProperty(PROVIDER_PROPERTY_KEY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String reportStreamStr = System.getProperty(SLF4J_INTERNAL_REPORT_STREAM_KEY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String verbosityStr = System.getProperty(SLF4J_INTERNAL_VERBOSITY_KEY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
result = System.getProperty(key);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- @qwen-code/sdk prod — dist-only: no readable source
- @qwen-code/channel-base prod — dist-only: no readable source
- @qwen-code/channel-dingtalk prod — registry 404
- @qwen-code/channel-wecom prod — registry 404
- @qwen-code/channel-qqbot prod — registry 404
- @qwen-code/channel-feishu prod — registry 404
- @qwen-code/channel-telegram prod — registry 404
- @qwen-code/channel-weixin prod — registry 404
- @qwen-code/web-templates prod — registry 404
- @codemirror/autocomplete prod — dist-only: no readable source
- @codemirror/commands prod — dist-only: no readable source
- @codemirror/language prod — dist-only: no readable source
- @codemirror/merge prod — dist-only: no readable source
- @codemirror/state prod — dist-only: no readable source
- @codemirror/view prod — dist-only: no readable source
- telegram-markdown-formatter prod — dist-only: no readable source
- @tencent-connect/qqbot-connector prod — dist-only: no readable source
- tokio prod — no version pinned
- serde prod — no version pinned
- serde_json prod — no version pinned
- anyhow prod — no version pinned
- tracing prod — no version pinned
- tracing-subscriber prod — no version pinned
- cua-driver-core prod — no version pinned
- cursor-overlay prod — no version pinned
- pip-preview prod — no version pinned
- async-trait prod — cdn 403
- base64 prod — no version pinned
- uuid prod — no version pinned
- ureq prod — cdn 403
- semver prod — cdn 403
- wait-timeout prod — cdn 403
- tar prod — cdn 403
- flate2 prod — cdn 403
- thiserror prod — no version pinned
- resvg prod — cdn 403
- tiny-skia prod — cdn 403
- usvg prod — cdn 403
- indexmap prod — cdn 403