Close Open Privacy Scan

link https://github.com/dmlc/xgboost
bolt Snapshot: commit 13131cd
science engine v1.23
schedule 2026-07-26T10:06:30.646595+00:00

help Not analyzed — coverage too low to judge

Too little of this repository was analyzed to judge — 10/22 dependencies were scanned. This is not a clean result; it means the scan could not run far enough to reach one.

App Privacy Score

— /100
Not analyzed — coverage too low

Coverage too low to score · 14 finding(s)

Based on: 7 first-party package(s) · 10/22 deps analyzed

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 14 low
First-party packages: 2
Dependency packages: 2
Ecosystem: java

swap_horiz Application data flows

Not enough of this repository was analyzed to look for application data flows. Absence of findings here is not evidence of a clean result.

</> First-Party Code

first-party (java): jvm-packages/xgboost4j

java first-party
expand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:63
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:101
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:135

first-party (java): jvm-packages/xgboost4j-example

java first-party
expand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:48
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:91

</> Dependencies

com.esotericsoftware:kryo

java dependency
expand_more 2 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:38
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:44

commons-logging:commons-logging

java dependency
expand_more 7 low-confidence finding(s)
low env_fs — Environment-variable access. 7 locations
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1016
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1193
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1194
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:88
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:90
pkgs/java/[email protected]/org/apache/commons/logging/impl/LogFactoryImpl.java:211
pkgs/java/[email protected]/org/apache/commons/logging/impl/SimpleLog.java:216

Skipped dependencies

Production

  • scipy prod — sdist exceeds byte cap
  • nvidia-nccl-cu12 prod — no sdist (wheels only)
  • matplotlib prod — sdist exceeds byte cap
  • pyspark prod — sdist exceeds byte cap
  • org.scala-lang:scala-compiler prod — no sources jar (404)
  • org.scala-lang:scala-library prod — no sources jar (404)
  • org.scala-lang.modules:scala-collection-compat_${scala.binary.version} prod — no sources jar (404)
  • ml.dmlc:xgboost4j-spark_2.12 prod — no sources jar (404)
  • org.apache.hadoop:hadoop-common prod — no sources jar (404)
  • ml.dmlc:xgboost4j-flink_2.12 prod — no sources jar (404)
  • org.apache.flink:flink-clients prod — no sources jar (404)
  • ml.dmlc:xgboost4j_2.12 prod — no sources jar (404)