Close Open Privacy Scan

link https://github.com/exa-labs/exa-mcp-server
bolt Snapshot: commit b407605
science engine v1.23
schedule 2026-07-27T21:08:02.599996+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

smart_toy MCP server detected: @modelcontextprotocol/sdk — detected in dependencies, not a safety judgment.

App Privacy Score

97 /100
Low privacy risk

Low risk · 219 finding(s)

Based on: 1 first-party package(s) · 6/7 deps analyzed

Dependency score: 22 (High risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 91 medium 128 low
First-party packages: 1
Dependency packages: 5
Ecosystem: npm

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (91)
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/answer_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/answer_example.ts:16
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/answer_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/answer_example.ts:36
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/answer_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/answer_example.ts:41
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/chat_completion.ts:6
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/chat_completion.ts:26
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/get_contents_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/get_contents_example.ts:15
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/links_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/links_example.ts:14
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/links_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/links_example.ts:21
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:12
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:19
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:32
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:33
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/openai_responses.ts:6
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/openai_responses.ts:17
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:17
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:24
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:30
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:31
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:37
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:43
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:44
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:62
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:63
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:67
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_task_bulk_example.ts:5
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_task_bulk_example.ts:77
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:5
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:34
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:5
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:38
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/search_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/search_example.ts:11
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/search_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/search_example.ts:18
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:11
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:21
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:16
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:19
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/subpages.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/subpages.ts:19
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/subpages.ts:3
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/subpages.ts:30
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:35
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:41
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:65
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:71
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:78
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:15
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:49
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:15
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:50
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:15
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:68
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:56
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:70
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:76
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:106
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:107
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:108
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:111
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:114
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:118
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:122
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:123
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:125
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:137
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:146
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:63
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:64
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:74
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:78
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:80
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:91
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:103
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:107
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:118
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:120
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:128
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:135
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:140
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/websets_example.ts:143
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:101
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:103
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:105
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:116
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:117
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:121
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:123
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:145
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:147
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:150
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:171
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:193
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:196
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:200
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:216
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:218
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:240
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:248
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:112
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:166
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:213
medium exa-js tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11
  2. 2sinkpkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:259

</> First-Party Code

first-party (npm)

npm first-party
expand_more 24 low-confidence finding(s)
low env_fs — Environment-variable access. 23 locations
repo/api/mcp.ts:1
repo/api/mcp.ts:128
repo/api/mcp.ts:129
repo/api/mcp.ts:142
repo/api/mcp.ts:143
repo/api/mcp.ts:387
repo/api/mcp.ts:389
repo/api/mcp.ts:483
repo/api/mcp.ts:485
repo/api/mcp.ts:492
repo/api/mcp.ts:493
repo/api/mcp.ts:513
repo/api/mcp.ts:514
repo/api/mcp.ts:624
repo/api/mcp.ts:631
repo/api/mcp.ts:632
repo/api/mcp.ts:636
repo/api/well-known-oauth-protected-resource.ts:8
repo/api/well-known-openai-apps-challenge.ts:22
repo/src/stdio.ts:1
repo/src/tools/config.ts:51
repo/src/utils/auth.ts:3
repo/src/utils/auth.ts:4
low env_fs production #f4b451acb970847e capability detected · no path traced — Filesystem access.
repo/src/utils/agentSkill.ts:33 
  cached ??= stripFrontmatter(readFileSync(findSkillFile(), "utf8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

exa-js

npm dependency
medium pii_flow tooling Excluded from app score unknown #6b62827bc883be88 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:16 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:16 
    console.log("Answer result:", JSON.stringify(answer, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #9fa40a3f43f0a5b2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:36 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:36 
    console.log("Answer result:", JSON.stringify(structuredAnswer, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #a34518760d65c8dc — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:41 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:41 
    console.log("Answer result:", JSON.stringify(answerFromLocation, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #b22d970db1be7749 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/chat_completion.ts:26 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/chat_completion.ts:6 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/chat_completion.ts:26 
    console.log(chunk);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #fd620a654bb96885 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/get_contents_example.ts:15 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/get_contents_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/get_contents_example.ts:15 
    console.log("Get contents results:", contentsResponse.results);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #0d9b244e218a72fa — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/links_example.ts:14 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/links_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/links_example.ts:14 
    console.log("Search results with links:", JSON.stringify(search, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #d8323d5a92f636d8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/links_example.ts:21 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/links_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/links_example.ts:21 
      console.log("Get contents results with links:", JSON.stringify(contents, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #28a31adda4bb2619 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:12 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:12 
    console.log("Get contents results without livecrawl:", JSON.stringify(contentsWithoutLivecrawl, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #c234701d075c83af — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:19 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:19 
    console.log("Get contents results with livecrawl:", JSON.stringify(contentsWithLivecrawl, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #250fbf7fa4c72516 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:32 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:32 
    console.log("Length of text without livecrawl:", textWithoutLivecrawl.length);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #c56306a450c72c11 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:33 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:33 
    console.log("Length of text with livecrawl:", textWithLivecrawl.length);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #b7a053425ba8bd5b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/openai_responses.ts:17 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/openai_responses.ts:6 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/openai_responses.ts:17 
    console.log(chunk);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #05766eef5f809cad — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:17 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:17 
  console.log(`Created research: ${research.researchId}\n`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #604d5064b8697871 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:24 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:24 
  console.log(`  - Status: ${withoutEvents.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #02d56b954277012a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:30 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:30 
  console.log(`  - Has events array: ${Array.isArray(withoutEvents.events)}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #c4453f3b519ecfcb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:31 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:31 
  console.log(`  - Events count: ${withoutEvents.events?.length ?? 0}\n`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8ebe8608a898f52d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:37 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:37 
  console.log(`  - Status: ${withEvents.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #b065da79410859a8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:43 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:43 
  console.log(`  - Has events array: ${Array.isArray(withEvents.events)}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #e85c900430bdba5f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:44 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:44 
  console.log(`  - Events count: ${withEvents.events?.length ?? 0}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #7ce1765c872cb85a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:62 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:62 
  console.log(`  - Final status: ${finalState.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6879b44fdc9f3ed2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:63 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:63 
  console.log(`  - Total events: ${finalState.events?.length ?? 0}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1ae7a5503035ede3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:67 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:67 
    console.log(finalState.output.content.substring(0, 200) + "...");

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #2b60c0fcf60b3d0f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_task_bulk_example.ts:77 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_task_bulk_example.ts:5 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_task_bulk_example.ts:77 
      console.log("Event:", JSON.stringify(event, undefined, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #2137b5e6fb4277a4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:34 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:5 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:34 
  console.log("Created Research ID:", research.researchId);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #494dc4235e4dd764 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:38 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:5 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:38 
    console.log("Research Event:", event);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #71fdfdaa0fe16e84 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/search_example.ts:11 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_example.ts:11 
    console.log("Search results:", searchResponse.results);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #a599f2a85b5fedfe — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/search_example.ts:18 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_example.ts:18 
    console.log("Search results with contents:", searchWithContentsResponse.results);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5a42aac48d37368d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:11 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:11 
    console.log(
      "Search results:",
      searchResponse.results.map((it) => it)
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #cde21fb34e155dcb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:21 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:21 
    console.log(
      "Search results with contents:",
      searchWithContentsResponse.results
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #d8574011361b657e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:16 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:16 
        console.log("\nChunk:", chunk.content); // Write partial text as it arrives

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #341d4cb4f3839dd2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:19 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:19 
        console.log("\nCitations:", chunk.citations); // Handle citations when they arrive

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #0cfc8331740f726d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/subpages.ts:19 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/subpages.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/subpages.ts:19 
    console.log(
      "Search results with subpages:",
      JSON.stringify(search, null, 2)
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #4be7d93a41d8d23c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/subpages.ts:30 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/subpages.ts:3 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/subpages.ts:30 
      console.log(
        "Get contents results with subpages:",
        JSON.stringify(contents, null, 2)
      );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #59e4a625e0705760 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:35 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:35 
    console.log(`✓ Created known companies webset: ${knownCompaniesWebset.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #98834cde165b151d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:41 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:41 
    console.log(`\nKnown companies (${knownItems.data.length} found):`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1ced7fb05f440214 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:65 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:65 
    console.log(`✓ Created new webset: ${newWebset.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #a270f61b3d4c6eff — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:71 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:71 
    console.log(`\nNew companies found (${newItems.data.length} total):`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1c54e10e500d6fb2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:78 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:78 
    console.log(
      `\n✓ Successfully excluded ${knownItems.data.length} known companies from search`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #3c1d9a1293f662b7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:49 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:15 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:49 
    console.log(`  ID: ${createdImport.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #b5cf3695d4d70b72 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:50 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:15 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:50 
    console.log(`  Status: ${createdImport.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #cfcf82edee92e447 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:68 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:15 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:68 
    console.log(`  Records processed: ${completedImport.count}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5a726b73cecb404a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:56 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:56 
    console.log(`✓ Created webset: https://websets.exa.ai/${webset.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #7ebe55846004f090 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:70 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:70 
    console.log(`✓ Webset found ${itemsResponse.data.length} items`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #bd3713c8e0636a76 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:76 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:76 
        console.log(`  - ${item.properties.description}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #885fc298989821c9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:106 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:106 
    console.log(`✓ Created monitor: ${monitor.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #0314cab098bd4ea0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:107 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:107 
    console.log(`  Status: ${monitor.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #cec72afc5331011d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:108 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:108 
    console.log(`  Next run: ${monitor.nextRunAt || "Not scheduled"}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5b7c9d2c478b928f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:111 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:111 
    console.log(`\nMonitors for webset ${webset.id}:`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #0bdb5ba83f25fcb4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:114 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:114 
      console.log(`  - ${m.id}: ${m.behavior.type} monitor (${m.status})`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #3e37ac40986352c0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:118 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:118 
    console.log(`\nMonitor runs for ${monitor.id}:`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #01e0dfa6b17662ab — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:122 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:122 
        console.log(`  - Run ${run.id}: ${run.status} (${run.type})`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #58229f91ec6f453d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:123 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:123 
        console.log(`    Created: ${run.createdAt}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #dd2acb4271c2edaa — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:125 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:125 
          console.log(`    Completed: ${run.completedAt}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #90517edc5e279ecb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:137 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:137 
    console.log(`✓ Monitor status updated to: ${updatedMonitor.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #3c50d32589f84b34 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:146 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:146 
    console.log(`- View your webset at: https://websets.exa.ai/${webset.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #20055e13babae696 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:63 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:63 
  console.log(`Webset created with ID: ${webset.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #03754f2cd9dbb503 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:64 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:64 
  console.log(`Status: ${webset.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #e2053f7c40950a68 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:74 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:74 
  console.log(`Webset processing complete. Status: ${idleWebset.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #7376e274aef7654b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:78 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:78 
  console.log(`Found ${items.data.length} items:`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #73008551bbbaaf1f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:80 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:80 
    console.log(
      `- ${
        item.properties.type === "company"
          ? item.properties.company.name
          : "Unknown"
      }: ${item.properties.url}`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #28197073a5d3f2a0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:91 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:91 
  console.log(`Retrieved ${allItems.length} items in total`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8881d1e0d37bc6bf — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:103 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:103 
  console.log(`Enrichment created with ID: ${enrichment.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8e6055849c82d3f1 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:107 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:107 
  console.log(`Expanded Webset has ${expandedWebset.items?.length ?? 0} items`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #719706a83599c57a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:118 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:118 
  console.log(`Found ${events.data.length} recent events:`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #4f81ec473214dcec — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:120 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:120 
    console.log(`- ${event.type} at ${event.createdAt}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #4adf425c48858150 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:128 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:128 
  console.log(`Webhook created with ID: ${webhook.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #4fa51ef84715c17f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:135 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:135 
  console.log(`Found ${attempts.data.length} webhook attempts`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #59d4f36aceabc787 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:140 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:140 
      console.log(
        `- ${attempt.eventType} at ${attempt.attemptedAt} (${attempt.successful ? "success" : "failed"})`
      );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #f3b816a363ed7b3f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:143 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:143 
      console.log(`  Status code: ${attempt.responseStatusCode}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5c034295a9f8aecb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:101 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:101 
    console.log("Title:", comparison.title);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #2db1d2594972a2b9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:103 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:103 
    console.log(comparison.executive_summary);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #36b5e54437d9af89 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:105 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:105 
    console.log("\nItems Compared:", comparison.items_compared.join(", "));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5468dbe90c7d49cf — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:116 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:116 
      console.log(`\nRecommended Choice: ${comparison.winner}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #85dbd95489b1a925 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:117 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:117 
      console.log(`Reasoning: ${comparison.reasoning}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #902d0d78be3442ef — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:121 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:121 
    console.log(comparison.recommendation);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #b5de7287e0ed0f78 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:123 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:123 
    console.log(`\nSources: ${response.citations.length} citations`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #3fe0693b81929f57 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:145 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:145 
    console.log("Topic:", explanation.topic);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #475c39e1efbfe905 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:147 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:147 
    console.log(explanation.simple_explanation);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #a0ff4df7ee86c21c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:150 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:150 
    console.log(explanation.technical_details);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #d33b770e5470aeb8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:171 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:171 
    console.log(`\nSources: ${response.citations.length} citations`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #3e8104a6380a767c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:193 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:193 
    console.log("Market:", research.market_name);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8422c3399159a6b3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:196 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:196 
      console.log("Market Size:", research.market_size);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1745d512a10778b5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:200 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:200 
      console.log("Growth Rate:", research.growth_rate);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #baa25a07d20bcb2d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:216 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:216 
    console.log(research.outlook);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #066ccb113c2d4049 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:218 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:218 
    console.log(`\nSources: ${response.citations.length} citations`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #ea1d036e782de135 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:240 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:240 
    console.log("Summary:", comparison.summary);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #9b8512664c7f7c7f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:248 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:248 
    console.log(`\nSources: ${response.citations.length} citations`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #4684a03a092b1455 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:112 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:112 
    console.log(
      `Created research ${research.researchId}, polling for completion...`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #118c69a7e1d1e81e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:166 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:166 
    console.log(
      `Created research ${research.researchId}, polling for completion...`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #92161c724f629195 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:213 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:213 
    console.log(
      `Created research ${research.researchId}, polling for completion...`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #e0a22d527a972f82 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:259 · flow /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11 → /tmp/closeopen-v19hp7r_/pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:259 
    console.log(
      `Created research ${research.researchId}, polling for completion...`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 37 low-confidence finding(s)
low env_fs — Environment-variable access. 30 locations
pkgs/npm/[email protected]__reposrc/examples/answer_example.ts:3
pkgs/npm/[email protected]__reposrc/examples/chat_completion.ts:6
pkgs/npm/[email protected]__reposrc/examples/get_contents_example.ts:3
pkgs/npm/[email protected]__reposrc/examples/links_example.ts:3
pkgs/npm/[email protected]__reposrc/examples/livecrawl_example.ts:3
pkgs/npm/[email protected]__reposrc/examples/next/app/api/route.ts:4
pkgs/npm/[email protected]__reposrc/examples/node/server.ts:4
pkgs/npm/[email protected]__reposrc/examples/openai_responses.ts:6
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:4
pkgs/npm/[email protected]__reposrc/examples/research_events_example.ts:5
pkgs/npm/[email protected]__reposrc/examples/research_task_bulk_example.ts:5
pkgs/npm/[email protected]__reposrc/examples/research_task_bulk_example.ts:6
pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:5
pkgs/npm/[email protected]__reposrc/examples/research_task_stream_example.ts:6
pkgs/npm/[email protected]__reposrc/examples/schema_summary_example.ts:3
pkgs/npm/[email protected]__reposrc/examples/search_example.ts:3
pkgs/npm/[email protected]__reposrc/examples/search_with_contents.ts:3
pkgs/npm/[email protected]__reposrc/examples/streaming_example.ts:3
pkgs/npm/[email protected]__reposrc/examples/subpages.ts:3
pkgs/npm/[email protected]__reposrc/examples/websets/exclude_example.ts:16
pkgs/npm/[email protected]__reposrc/examples/websets/import_example.ts:15
pkgs/npm/[email protected]__reposrc/examples/websets/monitors_example.ts:28
pkgs/npm/[email protected]__reposrc/examples/websets_example.ts:29
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:11
pkgs/npm/[email protected]__reposrc/examples/zod_answer_example.ts:12
pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:11
pkgs/npm/[email protected]__reposrc/examples/zod_research_example.ts:12
pkgs/npm/[email protected]__reposrc/examples/zod_summary_example.ts:11
pkgs/npm/[email protected]__reposrc/examples/zod_summary_example.ts:12
pkgs/npm/[email protected]__reposrc/src/index.ts:849
low env_fs — Filesystem access. 2 locations
pkgs/npm/[email protected]__reposrc/scripts/generate-docs.ts:3
pkgs/npm/[email protected]__reposrc/scripts/generate-docs.ts:60
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
pkgs/npm/[email protected]__reposrc/src/agent/base.ts:29
pkgs/npm/[email protected]__reposrc/src/monitors/base.ts:25
pkgs/npm/[email protected]__reposrc/src/research/base.ts:26
pkgs/npm/[email protected]__reposrc/src/websets/base.ts:66
pkgs/npm/[email protected]__reposrc/src/websets/imports.ts:145

@modelcontextprotocol/sdk

npm dependency
expand_more 38 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 22 locations
pkgs/npm/@[email protected]__reposrc/scripts/cli.ts:54
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:32
pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:632
pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:663
pkgs/npm/@[email protected]__reposrc/src/examples/client/multipleClientsParallel.ts:64
pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:95
pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:167
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:232
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:290
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:510
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:601
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:632
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:719
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:748
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:777
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:798
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:826
pkgs/npm/@[email protected]__reposrc/src/examples/client/ssePollingClient.ts:75
pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:139
pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:172
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:245
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:643
low egress tooling Excluded from app score unknown #ea8439cdd15977c2 capability detected · no path traced — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:16 
    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #d87d4f2da02ae157 capability detected · no path traced — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:77 
        writeFileSync(outputPath, fullContent, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Environment-variable access. 14 locations
pkgs/npm/@[email protected]__reposrc/src/client/stdio.ts:79
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:26
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:29
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:36
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:38
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:48
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationFormExample.ts:350
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:215
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:216
pkgs/npm/@[email protected]__reposrc/src/examples/server/honoWebStandardStreamableHttp.ts:69
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:621
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:622
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleTaskInteractive.ts:448
pkgs/npm/@[email protected]__reposrc/src/server/auth/router.ts:12

jose

npm dependency
expand_more 23 low-confidence finding(s)
low env_fs — Filesystem access. 21 locations
pkgs/npm/[email protected]__reposrc/tap/.browser.ts:5
pkgs/npm/[email protected]__reposrc/tools/iife-to-umd.cjs:1
pkgs/npm/[email protected]__reposrc/tools/iife-to-umd.cjs:14
pkgs/npm/[email protected]__reposrc/tools/iife-to-umd.cjs:28
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:4
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:7
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:18
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:21
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:23
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:35
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:37
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:64
pkgs/npm/[email protected]__reposrc/tools/postbump.cjs:108
pkgs/npm/[email protected]__reposrc/tools/prebump.cjs:2
pkgs/npm/[email protected]__reposrc/tools/prebump.cjs:11
pkgs/npm/[email protected]__reposrc/tools/publish.cjs:1
pkgs/npm/[email protected]__reposrc/tools/publish.cjs:3
pkgs/npm/[email protected]__reposrc/tools/publish.cjs:8
pkgs/npm/[email protected]__reposrc/tools/release-notes.cjs:1
pkgs/npm/[email protected]__reposrc/tools/release-notes.cjs:8
pkgs/npm/[email protected]__reposrc/tools/release-notes.cjs:10
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
pkgs/npm/[email protected]__reposrc/tap/jwks.ts:11
pkgs/npm/[email protected]__reposrc/tap/jwks.ts:14

mcp-handler

npm dependency
expand_more 5 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
pkgs/npm/[email protected]__reposrc/examples/auth/route.ts:48
pkgs/npm/[email protected]__reposrc/examples/route.ts:26
pkgs/npm/[email protected]__reposrc/src/handler/mcp-api-handler.ts:233
low env_fs — Filesystem access. 2 locations
pkgs/npm/[email protected]__reposrc/src/cli/index.ts:98
pkgs/npm/[email protected]__reposrc/src/cli/index.ts:114

whoami

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #1acac4fc4b1f67ae capability detected · no path traced — Environment-variable access.
pkgs/npm/[email protected]/index.js:9 
var result = name ? name : process.env.USER;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • agnost prod — dist-only: no readable source