Close Open Privacy Scan

link https://github.com/mckaywrigley/chatbot-ui
bolt Snapshot: commit 81328b6
science engine v1.23
schedule 2026-07-25T06:14:14.448249+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

smart_toy AI deps detected: @anthropic-ai/sdk, @google/generative-ai, @mistralai/mistralai, ai +2 more — detected in dependencies, not a safety judgment.

App Privacy Score

82 /100
Low privacy risk

Low risk · 1190 finding(s)

Based on: 2 first-party package(s) · 69/70 deps analyzed

Dependency score: 22 (High risk)

bar_chart Score Breakdown

egress −15
env_fs −3

list Scan Summary

0 high 102 medium 1088 low
First-party packages: 2
Dependency packages: 26
Ecosystem: npm

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (102)
medium @vercel/edge-config dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
  1. 1sourcepkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:144
  2. 2sinkpkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:180
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:30
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:42
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:45
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:51
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:53
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:59
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:15
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:33
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:27
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_embeddings.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_embeddings.ts:20
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_files.ts:6
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_files.ts:24
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_files.ts:6
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_files.ts:28
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_files.ts:6
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_files.ts:32
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_files.ts:6
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_files.ts:36
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_function_calling.ts:127
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_function_calling.ts:128
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_function_calling.ts:147
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:150
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:151
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_json_format.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_json_format.ts:16
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:6
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:33
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:15
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:52
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4
  2. 2sinkpkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:70
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:27
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:23
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:38
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:107
  2. 2sinkpkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:153
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:162
  2. 2sinkpkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:213
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/reasoning.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/reasoning.ts:35
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/reasoning.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/reasoning.ts:42
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/reasoning.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/reasoning.ts:47
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14
  2. 2sinkpkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:61
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14
  2. 2sinkpkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:74
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7
  2. 2sinkpkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:30
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7
  2. 2sinkpkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:32
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:30
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:47
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3
  2. 2sinkpkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:50
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:18
  2. 2sinkpkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:35
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/api_version.js:26
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/api_version.js:33
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:34
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:58
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:34
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:65
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:114
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:134
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:114
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:138
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:114
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:151
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:192
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:216
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:225
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:251
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:261
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:284
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/cache.js:261
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/cache.js:291
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/chat.js:30
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/chat.js:45
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/chat.js:30
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/chat.js:47
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/embed.js:24
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/embed.js:31
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/embed.js:39
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/embed.js:56
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:31
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:41
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:31
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:69
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:78
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:102
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:78
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:117
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:126
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:133
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:126
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:161
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:170
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:194
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:170
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:209
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:222
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:239
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:220
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:267
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:275
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:281
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:290
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:304
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/files.js:314
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/files.js:327
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
  1. 1sourcepkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223
  2. 2sinkpkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255

</> First-Party Code

first-party (npm)

npm first-party
expand_more 49 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 11 locations
repo/app/[locale]/[workspaceid]/layout.tsx:108
repo/app/api/chat/tools/route.ts:153
repo/app/api/chat/tools/route.ts:178
repo/components/chat/chat-helpers/index.ts:257
repo/components/chat/chat-ui.tsx:89
repo/components/sidebar/items/all/sidebar-create-item.tsx:132
repo/components/sidebar/items/all/sidebar-update-item.tsx:517
repo/components/utility/drawing-canvas.tsx:73
repo/components/utility/global-state.tsx:180
repo/components/workspace/workspace-settings.tsx:89
repo/lib/models/fetch-models.ts:57
low env_fs — Environment-variable access. 37 locations
repo/app/[locale]/layout.tsx:75
repo/app/[locale]/layout.tsx:76
repo/app/[locale]/login/page.tsx:24
repo/app/[locale]/login/page.tsx:25
repo/app/[locale]/login/page.tsx:86
repo/app/[locale]/login/page.tsx:90
repo/app/api/chat/custom/route.ts:21
repo/app/api/chat/custom/route.ts:22
repo/app/api/retrieval/process/docx/route.ts:21
repo/app/api/retrieval/process/docx/route.ts:22
repo/app/api/retrieval/process/route.ts:19
repo/app/api/retrieval/process/route.ts:20
repo/app/api/retrieval/retrieve/route.ts:20
repo/app/api/retrieval/retrieve/route.ts:21
repo/app/api/username/available/route.ts:14
repo/app/api/username/available/route.ts:15
repo/app/api/username/get/route.ts:14
repo/app/api/username/get/route.ts:15
repo/components/chat/chat-helpers/index.ts:163
repo/components/utility/global-state.tsx:147
repo/components/utility/profile-settings.tsx:618
repo/db/storage/files.ts:13
repo/lib/envs.ts:5
repo/lib/models/fetch-models.ts:58
repo/lib/server/server-chat-helpers.ts:9
repo/lib/server/server-chat-helpers.ts:10
repo/lib/server/server-chat-helpers.ts:61
repo/lib/server/server-chat-helpers.ts:62
repo/lib/supabase/browser-client.ts:5
repo/lib/supabase/browser-client.ts:6
repo/lib/supabase/client.ts:5
repo/lib/supabase/client.ts:6
repo/lib/supabase/middleware.ts:13
repo/lib/supabase/middleware.ts:14
repo/lib/supabase/server.ts:6
repo/lib/supabase/server.ts:7
repo/next.config.js:2
low egress production #cffa3141a23f5ace capability detected · no path traced — Hardcoded external endpoint. Review what data is sent to this destination.
repo/lib/models/fetch-models.ts:84 
    const response = await fetch("https://openrouter.ai/api/v1/models")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

first-party (npm): __tests__/playwright-test

npm first-party
expand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
repo/__tests__/playwright-test/playwright.config.ts:17
repo/__tests__/playwright-test/playwright.config.ts:19
repo/__tests__/playwright-test/playwright.config.ts:21

</> Dependencies

@google/generative-ai

npm dependency
medium pii_flow dependency Excluded from app score #662e96ad9f233b31 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #de7cf7168b8d8974 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:58 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:58 
  console.log(cacheResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #69559a95b3a80107 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:65 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:65 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #218a6870d9f0cbe1 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:134 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:134 
  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #4bd642a99402579b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:138 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:138 
  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9b323123b3eb4dee — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:151 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:151 
  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #e7e797d9ed235f0b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:216 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:192 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:216 
  console.log(cacheGetResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ece69329785d5ec9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:251 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:225 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:251 
    console.log(item);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #24b0ab43dd511fc4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:284 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:284 
  console.log("initial cache data:", cacheResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #20f1aef5605a6bf2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:291 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/cache.js:291 
  console.log("updated cache data:", cacheUpdateResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #8640db2898947e5d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:45 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/chat.js:45 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5a28ae8cb99c2c27 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:47 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/chat.js:47 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #319db87901736662 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #04b99df8c6aee9e4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #748ceaa8fce1f623 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9d6e4f9172e32afc — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #027323b583d76bf5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #683f3be989e5d8c3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45 
  console.log(countResult.totalTokens); // 11

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #aa78289e909e05d4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #0d5ae19a6773dfca — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86 
  console.log(countResult.totalTokens); // 10

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #3284d3e7643df3ec — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96 
  console.log(chatResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #36e9c7d84d4c2827 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132 
  console.log(countResult.totalTokens); // 265

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c4b93447d1bc50e0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #0e436908572a467f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178 
  console.log(countResult.totalTokens); // 265

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #dcb8d0596d84005c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6d82aa0a2c85f9e8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242 
  console.log(countResult.totalTokens); // 302

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5b574469e8071877 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c7e1b903fa964581 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302 
  console.log(result.totalTokens); // 10

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #18c5962b6d2528d0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #eafa4518fb744d0f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335 
  console.log(resultNoInstructions);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c1b7372f2d2ab2c0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349 
  console.log(resultWithInstructions);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #56c2bd75ff98e680 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368 
  console.log(resultNoTools);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #8957f9283d5217b7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388 
  console.log(resultWithTools);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ad2aea2ac88cf12a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:31 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/embed.js:24 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/embed.js:31 
  console.log(result.embedding);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #12eb13b184ecac06 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:56 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/embed.js:39 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/embed.js:56 
  console.log(result.embeddings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5d6a178929c2504e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:41 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:41 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6fdf2bec42a9f0fe — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:69 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:69 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7db9e6ff6f56abea — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:102 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:102 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #724269648dd2b196 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:117 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:117 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #4da530301e18e533 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:133 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:133 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #47e7a8a753b0ca66 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:161 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:161 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #53d1a8bcef5970e6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:194 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:194 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #0e96bc5b5121d8b6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:209 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:209 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #91a743612bfcae5c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:239 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:222 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:239 
  console.log(
    `Uploaded file ${uploadResponse.file.displayName} as: ${uploadResponse.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #62a101652a394dad — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:267 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:220 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:267 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #261458edef449f0b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:281 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:275 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:281 
    console.log(`name: ${file.name} | display name: ${file.displayName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #cecfe7f8023fb3d4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:304 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:290 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:304 
  console.log(
    `Retrieved file ${getResponse.displayName} as ${getResponse.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #acf29067656899fe — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:327 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:314 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/files.js:327 
  console.log(`Deleted ${uploadResult.file.displayName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2b01d782f67aa6cd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93 
    console.log(result2.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #21705b50fff8cc1a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37 
    console.log(result.response.candidates[0].logprobsResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #72175d2d49a97037 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #dba0ed61d7011b3a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50 
    console.log(result.response.candidates[0].safetyRatings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a309ab77d9b62951 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85 
    console.log(result.response.candidates[0].safetyRatings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #cf20dacbcacd433d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50 
  console.log(result.response.candidates[0].groundingMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7f407aaa381d4c8f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75 
  console.log(result.response.candidates[0].groundingMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5fea2cea70a47897 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35 
  console.log(text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #983f8e4fafcd0a31 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9d99b9c67f8bbf7a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9f7e19568b99670c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #cae4cf22bf267bbc — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #aed8ef77d6c9c410 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 156 low-confidence finding(s)
low env_fs — Filesystem access. 35 locations
pkgs/npm/@[email protected]__reposrc/rollup.config.mjs:32
pkgs/npm/@[email protected]__reposrc/samples/chat.js:19
pkgs/npm/@[email protected]__reposrc/samples/chat.js:98
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:24
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:114
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:20
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:70
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:98
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:131
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:163
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:200
pkgs/npm/@[email protected]__reposrc/samples/utils/check-samples.js:19
pkgs/npm/@[email protected]__reposrc/samples/utils/check-samples.js:30
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:19
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:27
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:90
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:134
pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:18
pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:70
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:18
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:22
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:33
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:84
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:26
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:71
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:112
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:147
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:194
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.ts:19
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.ts:57
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:18
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:35
pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:18
pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:68
pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:76
low env_fs — Environment-variable access. 121 locations
pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26
pkgs/npm/@[email protected]__reposrc/samples/cache.js:34
pkgs/npm/@[email protected]__reposrc/samples/cache.js:35
pkgs/npm/@[email protected]__reposrc/samples/cache.js:60
pkgs/npm/@[email protected]__reposrc/samples/cache.js:75
pkgs/npm/@[email protected]__reposrc/samples/cache.js:76
pkgs/npm/@[email protected]__reposrc/samples/cache.js:102
pkgs/npm/@[email protected]__reposrc/samples/cache.js:114
pkgs/npm/@[email protected]__reposrc/samples/cache.js:115
pkgs/npm/@[email protected]__reposrc/samples/cache.js:116
pkgs/npm/@[email protected]__reposrc/samples/cache.js:161
pkgs/npm/@[email protected]__reposrc/samples/cache.js:162
pkgs/npm/@[email protected]__reposrc/samples/cache.js:192
pkgs/npm/@[email protected]__reposrc/samples/cache.js:193
pkgs/npm/@[email protected]__reposrc/samples/cache.js:225
pkgs/npm/@[email protected]__reposrc/samples/cache.js:226
pkgs/npm/@[email protected]__reposrc/samples/cache.js:261
pkgs/npm/@[email protected]__reposrc/samples/cache.js:262
pkgs/npm/@[email protected]__reposrc/samples/chat.js:30
pkgs/npm/@[email protected]__reposrc/samples/chat.js:55
pkgs/npm/@[email protected]__reposrc/samples/chat.js:86
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:165
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:228
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:270
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:293
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358
pkgs/npm/@[email protected]__reposrc/samples/embed.js:24
pkgs/npm/@[email protected]__reposrc/samples/embed.js:39
pkgs/npm/@[email protected]__reposrc/samples/files.js:31
pkgs/npm/@[email protected]__reposrc/samples/files.js:58
pkgs/npm/@[email protected]__reposrc/samples/files.js:78
pkgs/npm/@[email protected]__reposrc/samples/files.js:106
pkgs/npm/@[email protected]__reposrc/samples/files.js:126
pkgs/npm/@[email protected]__reposrc/samples/files.js:150
pkgs/npm/@[email protected]__reposrc/samples/files.js:170
pkgs/npm/@[email protected]__reposrc/samples/files.js:198
pkgs/npm/@[email protected]__reposrc/samples/files.js:220
pkgs/npm/@[email protected]__reposrc/samples/files.js:222
pkgs/npm/@[email protected]__reposrc/samples/files.js:275
pkgs/npm/@[email protected]__reposrc/samples/files.js:290
pkgs/npm/@[email protected]__reposrc/samples/files.js:314
pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61
pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24
pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61
pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:45
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:92
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:157
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:226
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:265
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:268
pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:28
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:42
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:57
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:66
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:77
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:84
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:96
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:114
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:127
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:140
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:150
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:160
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:186
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:203
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:215
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:227
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:239
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:40
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:68
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:99
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:130
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:180
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:220
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:240
pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:33
pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:51
pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:70
pkgs/npm/@[email protected]__reposrc/test-integration/node/embed-content.test.ts:32
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:38
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-search-grounding.test.ts:37
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-tools.test.ts:35
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-tools.test.ts:179
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:39
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:66
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:88
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:103
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat-tools.test.ts:76
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:32
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:55
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:91
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:28
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:43
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:66
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:89
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:125
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:173
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:196
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:211
pkgs/npm/@[email protected]__reposrc/web-test-runner.config.mjs:17

@mistralai/mistralai

npm dependency
medium pii_flow tooling Excluded from app score unknown #7f49481783ea5ba8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:30 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:30 
console.log(`Created job with ID: ${job.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #279b5ec76f9aaf88 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:42 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:42 
  console.log(`Job status: ${job.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #4880844101f802f8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:45 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:45 
console.log(`Job is done, status ${job.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #f946d0ff679d9680 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:51 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:51 
      console.log(response.body);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6a9ff2ba47652d76 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:53 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:53 
      console.log(output);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6df9cb48ae4dab99 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:59 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:59 
  console.log(`Error file ID: ${job.errorFile}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #0d5819f99418b150 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:15 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:15 
console.log("Chat:", chatResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1195b905430ad29d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:33 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:33 
console.log(chatResponse.choices[0]?.message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #e78ee46f0a3dd8ca — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:27 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:27 
console.log("JSON:", chatResponse.choices[0].message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1960956c4537790b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:20 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:20 
console.log("Embeddings Batch:", embeddingsBatchResponse.data);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #9c2057a6841f4a5a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:24 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:24 
console.log(createdFile);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #9b0b3d2095861d2a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:28 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:28 
console.log(files);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #625dcd805e213deb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:32 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:32 
console.log(retrievedFile);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #bc512525becc49fd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:36 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_files.ts:36 
console.log(deletedFile);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #d843fbecac9de67b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:127 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:127 
  console.log(`calling functionName: ${functionName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #47a3bbca2d50dd8e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:128 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:128 
  console.log(`functionParams: ${toolCall.function.arguments}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #275bc371d1095d44 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:147 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:147 
console.log(response.choices[0].message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5493df2ce1a84355 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:150 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:150 
  console.log(`calling functionName: ${functionName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #bf76ab5cac324d99 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:151 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:151 
  console.log(`functionParams: ${toolCall.function.arguments}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8ee4bc7820ffe6cf — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_json_format.ts:16 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_json_format.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_json_format.ts:16 
console.log("Chat:", chatResponse.choices[0].message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #ab087af2a17a8531 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:33 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:6 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:33 
console.log("OCR ", ocrResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #681c5d88dbe0237b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:15 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:15 
console.log("OCR:", ocrResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #d87dd403361e2bef — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:52 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:52 
console.log("\n", parsedAccumulatedStream);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #88384cd1e138d4bd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:70 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:70 
console.log("\n", chatResponse.choices[0].message.parsed);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6d4a8ea4d2ae4f95 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:27 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:27 
console.log("Success", chatResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1e73ac86e4f61285 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:23 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:23 
console.log(`created prompt ${promptId} (v${prompt.version})`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1b03211138554af0 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:38 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:38 
console.log(`production -> v${live.version}: ${live.definition?.content}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5c067da511f4b5aa — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:153 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:107 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:153 
        console.error(`\nTranscription error: ${errorMessage}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #e4b5cac0c2f7fbf9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:213 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:162 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:213 
        console.error(`Transcription error: ${errorMessage}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #9a292cc31eb84e4b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:35 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning.ts:35 
  console.log(content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #dcb2e5ad69b0d734 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:42 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning.ts:42 
          console.log(inner.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #79dd6c1d482f8269 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:47 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning.ts:47 
      console.log(chunk.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #574389989088a52d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:61 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:61 
  console.log(
    `turn ${i + 1}: prompt=${String(promptTokens).padStart(4)} ` +
      `completion=${String(completionTokens).padStart(4)}  -> ${finalText(message.content)}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8f01cc887d6275a2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:74 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:74 
console.log(
  `TOTAL: prompt=${totalPrompt} completion=${totalCompletion} ` +
    `(sum ${totalPrompt + totalCompletion})`,
);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8dc41e325db727d2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:30 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:30 
  console.log(`typeof content = ${Array.isArray(content) ? "Array" : typeof content}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6fb9e97a095d4256 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:32 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:32 
  console.log(JSON.stringify(content, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #c2ddde3619b6112b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:30 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:30 
console.log(
  `created skill ${skillId} (v${skill.version}), assets: ${Object.keys(
    skill.definition?.assets ?? {},
  )}`,
);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #a31cd3307506fd9f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:47 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:47 
console.log(`published v${version.version}, moved 'main' to it`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #7b44472ac5659708 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:50 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:50 
console.log(
  `main -> v${runnable.version}: ${runnable.definition?.description}`,
);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #2016869cfcd9c219 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:35 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:18 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:35 
  console.log(result);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 59 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 18 locations
pkgs/npm/@[email protected]/esm/hooks/tracing.js:52
pkgs/npm/@[email protected]/esm/hooks/tracing.js:58
pkgs/npm/@[email protected]/esm/hooks/tracing.js:60
pkgs/npm/@[email protected]/esm/lib/http.js:11
pkgs/npm/@[email protected]/esm/lib/http.js:14
pkgs/npm/@[email protected]/esm/lib/sdks.js:147
pkgs/npm/@[email protected]/packages/mistralai-azure/src/lib/http.ts:19
pkgs/npm/@[email protected]/packages/mistralai-azure/src/lib/http.ts:21
pkgs/npm/@[email protected]/packages/mistralai-azure/src/lib/sdks.ts:259
pkgs/npm/@[email protected]/packages/mistralai-gcp/src/lib/http.ts:19
pkgs/npm/@[email protected]/packages/mistralai-gcp/src/lib/http.ts:21
pkgs/npm/@[email protected]/packages/mistralai-gcp/src/lib/sdks.ts:255
pkgs/npm/@[email protected]/src/hooks/tracing.ts:82
pkgs/npm/@[email protected]/src/hooks/tracing.ts:89
pkgs/npm/@[email protected]/src/hooks/tracing.ts:94
pkgs/npm/@[email protected]/src/lib/http.ts:19
pkgs/npm/@[email protected]/src/lib/http.ts:21
pkgs/npm/@[email protected]/src/lib/sdks.ts:259
low env_fs — Environment-variable access. 35 locations
pkgs/npm/@[email protected]/examples/src/async_audio_transcription_diarize.ts:3
pkgs/npm/@[email protected]/examples/src/async_audio_transcription_stream.ts:3
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3
pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:3
pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:3
pkgs/npm/@[email protected]/examples/src/async_chat_streaming.ts:3
pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:3
pkgs/npm/@[email protected]/examples/src/async_conversation_agent.ts:3
pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:3
pkgs/npm/@[email protected]/examples/src/async_files.ts:6
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3
pkgs/npm/@[email protected]/examples/src/async_jobs.ts:6
pkgs/npm/@[email protected]/examples/src/async_json_format.ts:3
pkgs/npm/@[email protected]/examples/src/async_list_models.ts:3
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:6
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:3
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4
pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:3
pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:8
pkgs/npm/@[email protected]/examples/src/error_handling.ts:4
pkgs/npm/@[email protected]/examples/src/gcp/async_chat_no_streaming.ts:3
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:38
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:43
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:107
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:46
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:51
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:162
pkgs/npm/@[email protected]/examples/src/reasoning.ts:3
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7
pkgs/npm/@[email protected]/examples/src/reasoning_with_streaming.ts:3
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3
pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:18
low env_fs — Filesystem access. 6 locations
pkgs/npm/@[email protected]/examples/src/async_files.ts:1
pkgs/npm/@[email protected]/examples/src/async_files.ts:19
pkgs/npm/@[email protected]/examples/src/async_jobs.ts:1
pkgs/npm/@[email protected]/examples/src/async_jobs.ts:19
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:2
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:16

@vercel/edge-config

npm dependency
medium pii_flow dependency Excluded from app score #cdb940700247b4a4 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:180 · flow /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:144 → /tmp/closeopen-mmve11am/pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:180 
              headers,

A credential (read from the environment/filesystem, or parsed from the request URL) is applied as authorization on the same outbound request. This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 13 low-confidence finding(s)
low env_fs — Environment-variable access. 9 locations
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:76
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:77
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:93
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:94
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:59
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:148
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:149
pkgs/npm/@[email protected]__sourcemap/src/index.ts:54
pkgs/npm/@[email protected]__sourcemap/src/utils/tracing.ts:53
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:306
pkgs/npm/@[email protected]__sourcemap/src/index.ts:70
pkgs/npm/@[email protected]__sourcemap/src/utils/fetch-with-cached-response.ts:119
pkgs/npm/@[email protected]__sourcemap/src/utils/fetch-with-cached-response.ts:144

@anthropic-ai/sdk

npm dependency
expand_more 266 low-confidence finding(s)
low env_fs — Filesystem access. 41 locations
pkgs/npm/@[email protected]/core/credentials.js:110
pkgs/npm/@[email protected]/core/credentials.js:210
pkgs/npm/@[email protected]/core/credentials.js:308
pkgs/npm/@[email protected]/core/credentials.mjs:73
pkgs/npm/@[email protected]/core/credentials.mjs:172
pkgs/npm/@[email protected]/core/credentials.mjs:268
pkgs/npm/@[email protected]/lib/credentials/credential-chain.js:203
pkgs/npm/@[email protected]/lib/credentials/credential-chain.mjs:166
pkgs/npm/@[email protected]/lib/credentials/identity-token.js:51
pkgs/npm/@[email protected]/lib/credentials/identity-token.mjs:14
pkgs/npm/@[email protected]/lib/credentials/types.js:195
pkgs/npm/@[email protected]/lib/credentials/types.mjs:154
pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:56
pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:20
pkgs/npm/@[email protected]/src/core/credentials.ts:154
pkgs/npm/@[email protected]/src/core/credentials.ts:258
pkgs/npm/@[email protected]/src/core/credentials.ts:372
pkgs/npm/@[email protected]/src/lib/credentials/credential-chain.ts:250
pkgs/npm/@[email protected]/src/lib/credentials/identity-token.ts:17
pkgs/npm/@[email protected]/src/lib/credentials/types.ts:222
pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:45
pkgs/npm/@[email protected]/src/tools/agent-toolset/fs-util.ts:112
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:457
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:533
pkgs/npm/@[email protected]/src/tools/memory/node.ts:4
pkgs/npm/@[email protected]/src/tools/memory/node.ts:52
pkgs/npm/@[email protected]/src/tools/memory/node.ts:101
pkgs/npm/@[email protected]/src/tools/memory/node.ts:256
pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.js:115
pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.mjs:107
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:390
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:469
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:375
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:454
pkgs/npm/@[email protected]/tools/memory/node.js:43
pkgs/npm/@[email protected]/tools/memory/node.js:91
pkgs/npm/@[email protected]/tools/memory/node.js:213
pkgs/npm/@[email protected]/tools/memory/node.mjs:2
pkgs/npm/@[email protected]/tools/memory/node.mjs:38
pkgs/npm/@[email protected]/tools/memory/node.mjs:86
pkgs/npm/@[email protected]/tools/memory/node.mjs:208
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 222 locations
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:53
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:76
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:120
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:49
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:72
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:116
pkgs/npm/@[email protected]/resources/beta/deployment-runs.js:23
pkgs/npm/@[email protected]/resources/beta/deployment-runs.mjs:20
pkgs/npm/@[email protected]/resources/beta/deployments.js:58
pkgs/npm/@[email protected]/resources/beta/deployments.js:79
pkgs/npm/@[email protected]/resources/beta/deployments.js:123
pkgs/npm/@[email protected]/resources/beta/deployments.js:144
pkgs/npm/@[email protected]/resources/beta/deployments.js:165
pkgs/npm/@[email protected]/resources/beta/deployments.js:186
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:55
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:76
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:120
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:141
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:162
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:183
pkgs/npm/@[email protected]/resources/beta/dreams.js:44
pkgs/npm/@[email protected]/resources/beta/dreams.js:86
pkgs/npm/@[email protected]/resources/beta/dreams.js:106
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:41
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:83
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:103
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:52
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:73
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:139
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:48
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:69
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:135
pkgs/npm/@[email protected]/resources/beta/environments/work.js:30
pkgs/npm/@[email protected]/resources/beta/environments/work.js:57
pkgs/npm/@[email protected]/resources/beta/environments/work.js:114
pkgs/npm/@[email protected]/resources/beta/environments/work.js:140
pkgs/npm/@[email protected]/resources/beta/environments/work.js:167
pkgs/npm/@[email protected]/resources/beta/environments/work.js:192
pkgs/npm/@[email protected]/resources/beta/environments/work.js:218
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:27
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:54
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:111
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:137
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:164
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:189
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:215
pkgs/npm/@[email protected]/resources/beta/files.js:69
pkgs/npm/@[email protected]/resources/beta/files.js:92
pkgs/npm/@[email protected]/resources/beta/files.mjs:66
pkgs/npm/@[email protected]/resources/beta/files.mjs:89
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:24
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:48
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:71
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:21
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:45
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:68
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:53
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:72
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:133
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:49
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:68
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:129
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.js:24
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.js:71
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.mjs:21
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.mjs:68
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:73
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:158
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:190
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:70
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:155
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:187
pkgs/npm/@[email protected]/resources/beta/models.js:25
pkgs/npm/@[email protected]/resources/beta/models.mjs:22
pkgs/npm/@[email protected]/resources/beta/sessions/events.js:61
pkgs/npm/@[email protected]/resources/beta/sessions/events.js:83
pkgs/npm/@[email protected]/resources/beta/sessions/events.mjs:58
pkgs/npm/@[email protected]/resources/beta/sessions/events.mjs:80
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:24
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:49
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:121
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:21
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:46
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:118
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:59
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:80
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:145
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:55
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:76
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:141
pkgs/npm/@[email protected]/resources/beta/sessions/threads/events.js:49
pkgs/npm/@[email protected]/resources/beta/sessions/threads/events.mjs:46
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.js:31
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.js:77
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.mjs:27
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.mjs:73
pkgs/npm/@[email protected]/resources/beta/skills/skills.js:49
pkgs/npm/@[email protected]/resources/beta/skills/skills.mjs:45
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:24
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:46
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:115
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:21
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:43
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:112
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:31
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:59
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:119
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:28
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:56
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:116
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:60
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:116
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:143
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:169
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:56
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:112
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:139
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:165
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:43
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:64
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:108
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:40
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:61
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:105
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:31
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:54
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:76
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:145
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:167
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:28
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:51
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:73
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:142
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:164
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:52
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:73
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:138
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:48
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:69
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:134
pkgs/npm/@[email protected]/resources/messages/batches.js:67
pkgs/npm/@[email protected]/resources/messages/batches.js:127
pkgs/npm/@[email protected]/resources/messages/batches.js:150
pkgs/npm/@[email protected]/resources/messages/batches.mjs:64
pkgs/npm/@[email protected]/resources/messages/batches.mjs:124
pkgs/npm/@[email protected]/resources/messages/batches.mjs:147
pkgs/npm/@[email protected]/resources/models.js:18
pkgs/npm/@[email protected]/resources/models.mjs:15
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:58
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:86
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:139
pkgs/npm/@[email protected]/src/resources/beta/deployment-runs.ts:30
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:69
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:95
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:148
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:174
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:200
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:226
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:51
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:102
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:127
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:74
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:100
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:180
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:43
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:71
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:138
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:169
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:201
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:231
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:258
pkgs/npm/@[email protected]/src/resources/beta/files.ts:85
pkgs/npm/@[email protected]/src/resources/beta/files.ts:113
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:30
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:59
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:87
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:91
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:115
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:190
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-versions.ts:31
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-versions.ts:95
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:82
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:181
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:221
pkgs/npm/@[email protected]/src/resources/beta/models.ts:31
pkgs/npm/@[email protected]/src/resources/beta/sessions/events.ts:82
pkgs/npm/@[email protected]/src/resources/beta/sessions/events.ts:109
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:31
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:61
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:152
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:174
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:200
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:283
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/events.ts:69
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/threads.ts:37
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/threads.ts:97
pkgs/npm/@[email protected]/src/resources/beta/skills/skills.ts:73
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:31
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:65
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:149
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:37
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:70
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:144
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:72
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:137
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:169
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:200
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:50
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:76
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:129
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:37
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:65
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:92
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:180
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:207
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:101
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:127
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:206
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:71
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:137
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:167
pkgs/npm/@[email protected]/src/resources/models.ts:24
low env_fs — Environment-variable access. 3 locations
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:806
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:755
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:740

@apidevtools/json-schema-ref-parser

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #b73be9c113ff51bf capability detected · no path traced — Filesystem access.
pkgs/npm/@[email protected]/lib/resolvers/file.ts:39 
      return await fs.promises.readFile(path);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #bb3c730751a3849c capability detected · no path traced — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/resolvers/http.ts:137 
  const response = await fetch(u, {
    method: "GET",
    headers: httpOptions.headers || {},
    credentials: httpOptions.withCredentials ? "include" : "same-origin",
    redirect: "manual",
    signal: controller ? controller.signal : null,
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@hookform/resolvers

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #e665f8e35e7ed2d9 capability detected · no path traced — Environment-variable access.
pkgs/npm/@[email protected]/yup/src/yup.ts:97 
      if (schemaOptions?.context && process.env.NODE_ENV === 'development') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@supabase/ssr

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #ca1055d69d32626a capability detected · no path traced — Environment-variable access.
pkgs/npm/@[email protected]/src/warnDeprecatedPackage.ts:19 
  const packageName = process.env.npm_package_name;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@supabase/supabase-js

npm dependency
expand_more 2 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
pkgs/npm/@[email protected]/src/lib/fetch.ts:17
pkgs/npm/@[email protected]/src/lib/fetch.ts:113

@xenova/transformers

npm dependency
expand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 6 locations
pkgs/npm/@[email protected]/src/env.js:25
pkgs/npm/@[email protected]/src/utils/hub.js:8
pkgs/npm/@[email protected]/src/utils/hub.js:109
pkgs/npm/@[email protected]/src/utils/hub.js:120
pkgs/npm/@[email protected]/src/utils/hub.js:131
pkgs/npm/@[email protected]/src/utils/hub.js:280
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 3 locations
pkgs/npm/@[email protected]/src/pipelines.js:2681
pkgs/npm/@[email protected]/src/utils/hub.js:199
pkgs/npm/@[email protected]/src/utils/hub.js:204

ai

npm dependency
expand_more 4 low-confidence finding(s)
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 4 locations
pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110
pkgs/npm/[email protected]/src/ui/call-completion-api.ts:57
pkgs/npm/[email protected]/src/ui/http-chat-transport.ts:191
pkgs/npm/[email protected]/src/ui/http-chat-transport.ts:246

class-variance-authority

npm dependency
expand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:15
pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:17
pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:18

d3-dsv

npm dependency
expand_more 12 low-confidence finding(s)
low env_fs — Filesystem access. 12 locations
pkgs/npm/[email protected]/bin/dsv2dsv.js:5
pkgs/npm/[email protected]/bin/dsv2dsv.js:17
pkgs/npm/[email protected]/bin/dsv2dsv.js:30
pkgs/npm/[email protected]/bin/dsv2dsv.js:32
pkgs/npm/[email protected]/bin/dsv2json.js:5
pkgs/npm/[email protected]/bin/dsv2json.js:16
pkgs/npm/[email protected]/bin/dsv2json.js:29
pkgs/npm/[email protected]/bin/dsv2json.js:33
pkgs/npm/[email protected]/bin/json2dsv.js:5
pkgs/npm/[email protected]/bin/json2dsv.js:16
pkgs/npm/[email protected]/bin/json2dsv.js:28
pkgs/npm/[email protected]/bin/json2dsv.js:31

gpt-tokenizer

npm dependency
expand_more 24 low-confidence finding(s)
low env_fs — Filesystem access. 22 locations
pkgs/npm/[email protected]/cjs/GptEncoding.test.js:39
pkgs/npm/[email protected]/cjs/GptEncoding.test.js:418
pkgs/npm/[email protected]/esm/GptEncoding.test.js:1
pkgs/npm/[email protected]/esm/GptEncoding.test.js:381
pkgs/npm/[email protected]/esm/codegen/generateByModel.js:1
pkgs/npm/[email protected]/esm/codegen/generateByModel.js:35
pkgs/npm/[email protected]/esm/codegen/generateByModel.js:68
pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:2
pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:20
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:2
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:47
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:105
pkgs/npm/[email protected]/src/GptEncoding.test.ts:1
pkgs/npm/[email protected]/src/GptEncoding.test.ts:500
pkgs/npm/[email protected]/src/codegen/generateByModel.ts:1
pkgs/npm/[email protected]/src/codegen/generateByModel.ts:55
pkgs/npm/[email protected]/src/codegen/generateByModel.ts:111
pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:2
pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:31
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:2
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:57
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:138
low env_fs — Environment-variable access. 2 locations
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:5
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:7

i18next-resources-to-backend

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
pkgs/npm/[email protected]/rollup.config.js:5
pkgs/npm/[email protected]/rollup.config.js:6

mammoth

npm dependency
expand_more 3 low-confidence finding(s)
low env_fs — Filesystem access. 3 locations
pkgs/npm/[email protected]/lib/docx/files.js:1
pkgs/npm/[email protected]/lib/main.js:3
pkgs/npm/[email protected]/lib/unzip.js:1

next-pwa

npm dependency
expand_more 18 low-confidence finding(s)
low env_fs — Filesystem access. 4 locations
pkgs/npm/[email protected]/build-custom-worker.js:4
pkgs/npm/[email protected]/build-fallback-worker.js:4
pkgs/npm/[email protected]/index.js:4
pkgs/npm/[email protected]/index.js:13
low env_fs — Environment-variable access. 12 locations
pkgs/npm/[email protected]/fallback.js:7
pkgs/npm/[email protected]/fallback.js:8
pkgs/npm/[email protected]/fallback.js:10
pkgs/npm/[email protected]/fallback.js:11
pkgs/npm/[email protected]/fallback.js:13
pkgs/npm/[email protected]/fallback.js:14
pkgs/npm/[email protected]/fallback.js:16
pkgs/npm/[email protected]/fallback.js:17
pkgs/npm/[email protected]/fallback.js:19
pkgs/npm/[email protected]/fallback.js:20
pkgs/npm/[email protected]/fallback.js:22
pkgs/npm/[email protected]/fallback.js:23
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 2 locations
pkgs/npm/[email protected]/register.js:18
pkgs/npm/[email protected]/register.js:53

next-themes

npm dependency
expand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
pkgs/npm/[email protected]__reposrc/playwright.config.ts:4
pkgs/npm/[email protected]__reposrc/playwright.config.ts:5
pkgs/npm/[email protected]__reposrc/playwright.config.ts:6
pkgs/npm/[email protected]__reposrc/playwright.config.ts:11

openai

npm dependency
expand_more 369 low-confidence finding(s)
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 6 locations
pkgs/npm/[email protected]/auth/subject-token-providers.js:50
pkgs/npm/[email protected]/auth/subject-token-providers.js:97
pkgs/npm/[email protected]/auth/subject-token-providers.mjs:44
pkgs/npm/[email protected]/auth/subject-token-providers.mjs:91
pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:81
pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:145
low env_fs — Environment-variable access. 3 locations
pkgs/npm/[email protected]/azure.js:44
pkgs/npm/[email protected]/azure.mjs:40
pkgs/npm/[email protected]/src/azure.ts:101
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 360 locations
pkgs/npm/[email protected]/resources/admin/organization/admin-api-keys.js:39
pkgs/npm/[email protected]/resources/admin/organization/admin-api-keys.mjs:36
pkgs/npm/[email protected]/resources/admin/organization/certificates.js:44
pkgs/npm/[email protected]/resources/admin/organization/certificates.js:62
pkgs/npm/[email protected]/resources/admin/organization/certificates.mjs:41
pkgs/npm/[email protected]/resources/admin/organization/certificates.mjs:59
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.js:48
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.js:65
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.mjs:44
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.mjs:61
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.js:22
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.js:42
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.mjs:19
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.mjs:39
pkgs/npm/[email protected]/resources/admin/organization/groups/users.js:22
pkgs/npm/[email protected]/resources/admin/organization/groups/users.js:42
pkgs/npm/[email protected]/resources/admin/organization/groups/users.mjs:19
pkgs/npm/[email protected]/resources/admin/organization/groups/users.mjs:39
pkgs/npm/[email protected]/resources/admin/organization/invites.js:41
pkgs/npm/[email protected]/resources/admin/organization/invites.mjs:38
pkgs/npm/[email protected]/resources/admin/organization/projects/api-keys.js:23
pkgs/npm/[email protected]/resources/admin/organization/projects/api-keys.mjs:20
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.js:20
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.js:38
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.mjs:17
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.mjs:35
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.js:29
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.js:49
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.mjs:25
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.mjs:45
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.js:23
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.js:43
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.mjs:20
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.mjs:40
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.js:20
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.js:37
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.mjs:17
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.mjs:34
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.js:20
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.js:38
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.mjs:17
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.mjs:35
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:80
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:97
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:134
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:76
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:93
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:130
pkgs/npm/[email protected]/resources/admin/organization/projects/rate-limits.js:39
pkgs/npm/[email protected]/resources/admin/organization/projects/rate-limits.mjs:36
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:22
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:42
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:61
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:19
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:39
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:58
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/api-keys.js:22
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/api-keys.mjs:19
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:30
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:50
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:69
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:26
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:46
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:65
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:30
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:50
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:78
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:27
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:47
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:75
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-limit.js:20
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-limit.js:42
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-limit.mjs:17
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-limit.mjs:39
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.js:23
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.js:43
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.mjs:20
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.mjs:40
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:30
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:50
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:69
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:26
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:46
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:65
pkgs/npm/[email protected]/resources/admin/organization/roles.js:38
pkgs/npm/[email protected]/resources/admin/organization/roles.js:54
pkgs/npm/[email protected]/resources/admin/organization/roles.mjs:35
pkgs/npm/[email protected]/resources/admin/organization/roles.mjs:51
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.js:45
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.js:71
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.mjs:42
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.mjs:68
pkgs/npm/[email protected]/resources/admin/organization/users/roles.js:22
pkgs/npm/[email protected]/resources/admin/organization/users/roles.js:42
pkgs/npm/[email protected]/resources/admin/organization/users/roles.mjs:19
pkgs/npm/[email protected]/resources/admin/organization/users/roles.mjs:39
pkgs/npm/[email protected]/resources/admin/organization/users/users.js:26
pkgs/npm/[email protected]/resources/admin/organization/users/users.js:41
pkgs/npm/[email protected]/resources/admin/organization/users/users.mjs:22
pkgs/npm/[email protected]/resources/admin/organization/users/users.mjs:37
pkgs/npm/[email protected]/resources/batches.js:22
pkgs/npm/[email protected]/resources/batches.js:40
pkgs/npm/[email protected]/resources/batches.mjs:19
pkgs/npm/[email protected]/resources/batches.mjs:37
pkgs/npm/[email protected]/resources/beta/assistants.js:32
pkgs/npm/[email protected]/resources/beta/assistants.js:44
pkgs/npm/[email protected]/resources/beta/assistants.mjs:29
pkgs/npm/[email protected]/resources/beta/assistants.mjs:41
pkgs/npm/[email protected]/resources/beta/chatkit/sessions.js:41
pkgs/npm/[email protected]/resources/beta/chatkit/sessions.mjs:38
pkgs/npm/[email protected]/resources/beta/chatkit/threads.js:20
pkgs/npm/[email protected]/resources/beta/chatkit/threads.mjs:17
pkgs/npm/[email protected]/resources/beta/responses/responses.js:34
pkgs/npm/[email protected]/resources/beta/responses/responses.js:80
pkgs/npm/[email protected]/resources/beta/responses/responses.mjs:30
pkgs/npm/[email protected]/resources/beta/responses/responses.mjs:76
pkgs/npm/[email protected]/resources/beta/threads/messages.js:21
pkgs/npm/[email protected]/resources/beta/threads/messages.js:35
pkgs/npm/[email protected]/resources/beta/threads/messages.js:48
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:18
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:32
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:45
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:26
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:43
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:56
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:83
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:163
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:22
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:39
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:52
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:79
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:159
pkgs/npm/[email protected]/resources/beta/threads/runs/steps.js:22
pkgs/npm/[email protected]/resources/beta/threads/runs/steps.mjs:19
pkgs/npm/[email protected]/resources/beta/threads/threads.js:44
pkgs/npm/[email protected]/resources/beta/threads/threads.js:56
pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:40
pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:52
pkgs/npm/[email protected]/resources/chat/completions/completions.js:42
pkgs/npm/[email protected]/resources/chat/completions/completions.js:61
pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:38
pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:57
pkgs/npm/[email protected]/resources/containers/containers.js:27
pkgs/npm/[email protected]/resources/containers/containers.mjs:23
pkgs/npm/[email protected]/resources/containers/files/content.js:14
pkgs/npm/[email protected]/resources/containers/files/content.mjs:11
pkgs/npm/[email protected]/resources/containers/files/files.js:25
pkgs/npm/[email protected]/resources/containers/files/files.js:32
pkgs/npm/[email protected]/resources/containers/files/files.mjs:21
pkgs/npm/[email protected]/resources/containers/files/files.mjs:28
pkgs/npm/[email protected]/resources/conversations/conversations.js:28
pkgs/npm/[email protected]/resources/conversations/conversations.js:37
pkgs/npm/[email protected]/resources/conversations/conversations.mjs:24
pkgs/npm/[email protected]/resources/conversations/conversations.mjs:33
pkgs/npm/[email protected]/resources/conversations/items.js:17
pkgs/npm/[email protected]/resources/conversations/items.js:29
pkgs/npm/[email protected]/resources/conversations/items.mjs:14
pkgs/npm/[email protected]/resources/conversations/items.mjs:26
pkgs/npm/[email protected]/resources/evals/evals.js:34
pkgs/npm/[email protected]/resources/evals/evals.js:40
pkgs/npm/[email protected]/resources/evals/evals.mjs:30
pkgs/npm/[email protected]/resources/evals/evals.mjs:36
pkgs/npm/[email protected]/resources/evals/runs/output-items.js:17
pkgs/npm/[email protected]/resources/evals/runs/output-items.mjs:14
pkgs/npm/[email protected]/resources/evals/runs/runs.js:25
pkgs/npm/[email protected]/resources/evals/runs/runs.js:36
pkgs/npm/[email protected]/resources/evals/runs/runs.js:66
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:21
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:32
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:62
pkgs/npm/[email protected]/resources/files.js:52
pkgs/npm/[email protected]/resources/files.js:74
pkgs/npm/[email protected]/resources/files.mjs:49
pkgs/npm/[email protected]/resources/files.mjs:71
pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.js:41
pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.mjs:38
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:52
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:86
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:118
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:134
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:48
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:82
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:114
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:130
pkgs/npm/[email protected]/resources/models.js:17
pkgs/npm/[email protected]/resources/models.mjs:14
pkgs/npm/[email protected]/resources/realtime/calls.js:21
pkgs/npm/[email protected]/resources/realtime/calls.js:37
pkgs/npm/[email protected]/resources/realtime/calls.js:54
pkgs/npm/[email protected]/resources/realtime/calls.js:70
pkgs/npm/[email protected]/resources/realtime/calls.mjs:18
pkgs/npm/[email protected]/resources/realtime/calls.mjs:34
pkgs/npm/[email protected]/resources/realtime/calls.mjs:51
pkgs/npm/[email protected]/resources/realtime/calls.mjs:67
pkgs/npm/[email protected]/resources/responses/responses.js:35
pkgs/npm/[email protected]/resources/responses/responses.js:88
pkgs/npm/[email protected]/resources/responses/responses.mjs:31
pkgs/npm/[email protected]/resources/responses/responses.mjs:84
pkgs/npm/[email protected]/resources/skills/content.js:13
pkgs/npm/[email protected]/resources/skills/content.mjs:10
pkgs/npm/[email protected]/resources/skills/skills.js:30
pkgs/npm/[email protected]/resources/skills/skills.js:36
pkgs/npm/[email protected]/resources/skills/skills.mjs:26
pkgs/npm/[email protected]/resources/skills/skills.mjs:32
pkgs/npm/[email protected]/resources/skills/versions/content.js:14
pkgs/npm/[email protected]/resources/skills/versions/content.mjs:11
pkgs/npm/[email protected]/resources/skills/versions/versions.js:21
pkgs/npm/[email protected]/resources/skills/versions/versions.js:28
pkgs/npm/[email protected]/resources/skills/versions/versions.mjs:17
pkgs/npm/[email protected]/resources/skills/versions/versions.mjs:24
pkgs/npm/[email protected]/resources/uploads/parts.js:26
pkgs/npm/[email protected]/resources/uploads/parts.mjs:23
pkgs/npm/[email protected]/resources/uploads/uploads.js:50
pkgs/npm/[email protected]/resources/uploads/uploads.js:73
pkgs/npm/[email protected]/resources/uploads/uploads.mjs:46
pkgs/npm/[email protected]/resources/uploads/uploads.mjs:69
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:16
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:28
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:40
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:13
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:25
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:37
pkgs/npm/[email protected]/resources/vector-stores/files.js:17
pkgs/npm/[email protected]/resources/vector-stores/files.js:29
pkgs/npm/[email protected]/resources/vector-stores/files.js:40
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:14
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:26
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:37
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:35
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:45
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:31
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:41
pkgs/npm/[email protected]/resources/videos.js:21
pkgs/npm/[email protected]/resources/videos.js:51
pkgs/npm/[email protected]/resources/videos.js:76
pkgs/npm/[email protected]/resources/videos.js:85
pkgs/npm/[email protected]/resources/videos.mjs:18
pkgs/npm/[email protected]/resources/videos.mjs:48
pkgs/npm/[email protected]/resources/videos.mjs:73
pkgs/npm/[email protected]/resources/videos.mjs:82
pkgs/npm/[email protected]/src/resources/admin/organization/admin-api-keys.ts:41
pkgs/npm/[email protected]/src/resources/admin/organization/certificates.ts:55
pkgs/npm/[email protected]/src/resources/admin/organization/certificates.ts:78
pkgs/npm/[email protected]/src/resources/admin/organization/groups/groups.ts:69
pkgs/npm/[email protected]/src/resources/admin/organization/groups/groups.ts:91
pkgs/npm/[email protected]/src/resources/admin/organization/groups/roles.ts:24
pkgs/npm/[email protected]/src/resources/admin/organization/groups/roles.ts:49
pkgs/npm/[email protected]/src/resources/admin/organization/groups/users.ts:23
pkgs/npm/[email protected]/src/resources/admin/organization/groups/users.ts:48
pkgs/npm/[email protected]/src/resources/admin/organization/invites.ts:47
pkgs/npm/[email protected]/src/resources/admin/organization/projects/api-keys.ts:32
pkgs/npm/[email protected]/src/resources/admin/organization/projects/data-retention.ts:21
pkgs/npm/[email protected]/src/resources/admin/organization/projects/data-retention.ts:44
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/groups.ts:38
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/groups.ts:59
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/roles.ts:29
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/roles.ts:54
pkgs/npm/[email protected]/src/resources/admin/organization/projects/hosted-tool-permissions.ts:21
pkgs/npm/[email protected]/src/resources/admin/organization/projects/hosted-tool-permissions.ts:43
pkgs/npm/[email protected]/src/resources/admin/organization/projects/model-permissions.ts:21
pkgs/npm/[email protected]/src/resources/admin/organization/projects/model-permissions.ts:44
pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:173
pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:191
pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:233
pkgs/npm/[email protected]/src/resources/admin/organization/projects/rate-limits.ts:57
pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:25
pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:46
pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:66
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/api-keys.ts:27
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:36
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:61
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:85
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:39
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:64
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:97
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-limit.ts:21
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-limit.ts:48
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/roles.ts:26
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/roles.ts:51
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:43
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:64
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:84
pkgs/npm/[email protected]/src/resources/admin/organization/roles.ts:40
pkgs/npm/[email protected]/src/resources/admin/organization/roles.ts:57
pkgs/npm/[email protected]/src/resources/admin/organization/spend-alerts.ts:51
pkgs/npm/[email protected]/src/resources/admin/organization/spend-alerts.ts:82
pkgs/npm/[email protected]/src/resources/admin/organization/users/roles.ts:25
pkgs/npm/[email protected]/src/resources/admin/organization/users/roles.ts:50
pkgs/npm/[email protected]/src/resources/admin/organization/users/users.ts:39
pkgs/npm/[email protected]/src/resources/admin/organization/users/users.ts:55
pkgs/npm/[email protected]/src/resources/batches.ts:26
pkgs/npm/[email protected]/src/resources/batches.ts:49
pkgs/npm/[email protected]/src/resources/beta/assistants.ts:40
pkgs/npm/[email protected]/src/resources/beta/assistants.ts:53
pkgs/npm/[email protected]/src/resources/beta/chatkit/sessions.ts:44
pkgs/npm/[email protected]/src/resources/beta/chatkit/threads.ts:26
pkgs/npm/[email protected]/src/resources/beta/responses/responses.ts:95
pkgs/npm/[email protected]/src/resources/beta/responses/responses.ts:151
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:24
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:39
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:53
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:74
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:92
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:106
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:139
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:265
pkgs/npm/[email protected]/src/resources/beta/threads/runs/steps.ts:25
pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:104
pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:117
pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:100
pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:124
pkgs/npm/[email protected]/src/resources/containers/containers.ts:37
pkgs/npm/[email protected]/src/resources/containers/files/content.ts:15
pkgs/npm/[email protected]/src/resources/containers/files/files.ts:28
pkgs/npm/[email protected]/src/resources/containers/files/files.ts:43
pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:41
pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:55
pkgs/npm/[email protected]/src/resources/conversations/items.ts:28
pkgs/npm/[email protected]/src/resources/conversations/items.ts:45
pkgs/npm/[email protected]/src/resources/evals/evals.ts:52
pkgs/npm/[email protected]/src/resources/evals/evals.ts:59
pkgs/npm/[email protected]/src/resources/evals/runs/output-items.ts:23
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:34
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:50
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:87
pkgs/npm/[email protected]/src/resources/files.ts:58
pkgs/npm/[email protected]/src/resources/files.ts:86
pkgs/npm/[email protected]/src/resources/fine-tuning/checkpoints/permissions.ts:60
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:58
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:97
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:139
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:156
pkgs/npm/[email protected]/src/resources/models.ts:18
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:24
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:41
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:59
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:80
pkgs/npm/[email protected]/src/resources/responses/responses.ts:158
pkgs/npm/[email protected]/src/resources/responses/responses.ts:223
pkgs/npm/[email protected]/src/resources/skills/content.ts:14
pkgs/npm/[email protected]/src/resources/skills/skills.ts:43
pkgs/npm/[email protected]/src/resources/skills/skills.ts:50
pkgs/npm/[email protected]/src/resources/skills/versions/content.ts:15
pkgs/npm/[email protected]/src/resources/skills/versions/versions.ts:24
pkgs/npm/[email protected]/src/resources/skills/versions/versions.ts:39
pkgs/npm/[email protected]/src/resources/uploads/parts.ts:28
pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:50
pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:74
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:25
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:42
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:59
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:24
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:41
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:53
pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:55
pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:70
pkgs/npm/[email protected]/src/resources/videos.ts:27
pkgs/npm/[email protected]/src/resources/videos.ts:74
pkgs/npm/[email protected]/src/resources/videos.ts:108
pkgs/npm/[email protected]/src/resources/videos.ts:118

pdf-parse

npm dependency
expand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 9 locations
pkgs/npm/[email protected]/bin/cli.mjs:27
pkgs/npm/[email protected]/bin/cli.mjs:103
pkgs/npm/[email protected]/bin/cli.mjs:156
pkgs/npm/[email protected]/bin/cli.mjs:167
pkgs/npm/[email protected]/bin/cli.mjs:179
pkgs/npm/[email protected]/bin/cli.mjs:208
pkgs/npm/[email protected]/bin/cli.mjs:278
pkgs/npm/[email protected]/bin/cli.test.mjs:59
pkgs/npm/[email protected]/bin/cli.test.mjs:90

react

npm dependency
expand_more 14 low-confidence finding(s)
low env_fs — Environment-variable access. 14 locations
pkgs/npm/[email protected]/cjs/react-compiler-runtime.development.js:12
pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.development.js:12
pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.react-server.development.js:12
pkgs/npm/[email protected]/cjs/react-jsx-runtime.development.js:12
pkgs/npm/[email protected]/cjs/react-jsx-runtime.react-server.development.js:12
pkgs/npm/[email protected]/cjs/react.development.js:12
pkgs/npm/[email protected]/cjs/react.react-server.development.js:12
pkgs/npm/[email protected]/compiler-runtime.js:10
pkgs/npm/[email protected]/index.js:3
pkgs/npm/[email protected]/jsx-dev-runtime.js:3
pkgs/npm/[email protected]/jsx-dev-runtime.react-server.js:3
pkgs/npm/[email protected]/jsx-runtime.js:3
pkgs/npm/[email protected]/jsx-runtime.react-server.js:3
pkgs/npm/[email protected]/react.react-server.js:3

react-dom

npm dependency
expand_more 23 low-confidence finding(s)
low env_fs — Environment-variable access. 23 locations
pkgs/npm/[email protected]/cjs/react-dom-server-legacy.browser.development.js:36
pkgs/npm/[email protected]/cjs/react-dom-server-legacy.node.development.js:36
pkgs/npm/[email protected]/cjs/react-dom-server.browser.development.js:36
pkgs/npm/[email protected]/cjs/react-dom-server.edge.development.js:36
pkgs/npm/[email protected]/cjs/react-dom-server.node.development.js:12
pkgs/npm/[email protected]/cjs/react-dom-test-utils.development.js:12
pkgs/npm/[email protected]/cjs/react-dom.development.js:12
pkgs/npm/[email protected]/cjs/react-dom.react-server.development.js:12
pkgs/npm/[email protected]/client.js:11
pkgs/npm/[email protected]/client.js:31
pkgs/npm/[email protected]/index.js:11
pkgs/npm/[email protected]/index.js:31
pkgs/npm/[email protected]/profiling.js:11
pkgs/npm/[email protected]/profiling.js:31
pkgs/npm/[email protected]/react-dom.react-server.js:3
pkgs/npm/[email protected]/server.browser.js:4
pkgs/npm/[email protected]/server.bun.js:5
pkgs/npm/[email protected]/server.edge.js:5
pkgs/npm/[email protected]/server.node.js:4
pkgs/npm/[email protected]/static.browser.js:4
pkgs/npm/[email protected]/static.edge.js:4
pkgs/npm/[email protected]/static.node.js:4
pkgs/npm/[email protected]/test-utils.js:3

react-hook-form

npm dependency
expand_more 12 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
pkgs/npm/[email protected]__reposrc/playwright.config.ts:6
pkgs/npm/[email protected]__reposrc/playwright.config.ts:7
pkgs/npm/[email protected]__reposrc/playwright.config.ts:15
pkgs/npm/[email protected]__reposrc/scripts/jest/jest.config.js:44
low env_fs — Filesystem access. 7 locations
pkgs/npm/[email protected]__reposrc/scripts/apiExtractor.js:3
pkgs/npm/[email protected]__reposrc/scripts/apiExtractor.js:64
pkgs/npm/[email protected]__reposrc/scripts/bench-compare.ts:10
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-cjs-exports.cjs:9
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-cjs-exports.cjs:15
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-esm-exports.mjs:9
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-esm-exports.mjs:20
low egress dependency Excluded from app score #cf5d6fb5b83f8a60 capability detected · no path traced — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]__reposrc/src/form.tsx:88 
            const response = await fetch(String(action), {
              method,
              headers: {
                ...headers,
                ...(encType && encType !== 'multipart/form-data'
                  ? { 'Content-Type': encType }
                  : {}),
              },
              body: shouldStringifySubmissionData ? formDataJson : formData,
            });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

react-i18next

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #13d3b7b855061e68 capability detected · no path traced — Environment-variable access.
pkgs/npm/[email protected]/src/useTranslation.js:221 
      inDevelopment = process.env.NODE_ENV !== 'production';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-syntax-highlighter

npm dependency
expand_more 24 low-confidence finding(s)
low env_fs — Filesystem access. 24 locations
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:6
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:34
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:50
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:70
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:103
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:117
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:6
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:30
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:53
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:73
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:108
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:122
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:6
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:35
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:44
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:57
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:75
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:120
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:3
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:53
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:58
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:67
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:82
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:146

react-textarea-autosize

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #611f51871f857963 capability detected · no path traced — Environment-variable access.
pkgs/npm/[email protected]__reposrc/.babelrc.js:1 
const test = process.env.NODE_ENV === 'test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sonner

npm dependency
expand_more 4 low-confidence finding(s)
low env_fs — Environment-variable access. 4 locations
pkgs/npm/[email protected]__reposrc/playwright.config.ts:26
pkgs/npm/[email protected]__reposrc/playwright.config.ts:28
pkgs/npm/[email protected]__reposrc/playwright.config.ts:30
pkgs/npm/[email protected]__reposrc/playwright.config.ts:42

Skipped dependencies

Production

  • next prod — tarball exceeds byte cap