Close Open Privacy Scan

link https://github.com/dmlc/xgboost
bolt Snapshot: commit e60421a
science engine v1.14
schedule 2026-07-17T03:17:21.747743+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

Incomplete scan — only 10/22 dependencies were analyzed. Treat the score as provisional.

App Privacy Score

97 /100
Low privacy risk

Low risk · 14 finding(s)

Dependency score: 97 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 14 low
First-party packages: 2
Dependency packages: 2
Ecosystem: java

swap_horiz External domains

academic.oup.comaclweb.orgaddress.localaggregate.ee.engr.uky.eduapi.nuget.orgarchive.ics.uci.eduarrow.apache.orgartowen.su.domainsarxiv.orgasyncssh.readthedocs.ioavro.apache.orgbitbucket.orgbmva-archive.org.ukbugreports.qt.iobugs.python.orgbugs.winehq.orgbugzilla.gnome.orgcdn.datatables.netcdn.jsdelivr.netcdn.mathjax.orgcens.ioc.eecgi.di.uoa.grciteseerx.ist.psu.educode.google.comcode.jquery.comcollaboration.cmc.ec.gc.cacommons.apache.orgcran.r-project.orgcrates.iocs.nyu.educseweb.ucsd.educve.mitre.orgdata-apis.orgdeveloper.mozilla.orgdigitalassets.lib.berkeley.edudistributed.dask.orgdistributed.readthedocs.iodl.acm.orgdmlc.github.iodoc.rust-lang.orgdocbook.sourceforge.netdocs.bodo.aidocs.dask.orgdocs.pytest.orgdocs.python.orgdocs.rsdocs.scipydocs.scipy.orgdocs.sqlalchemy.orgdocs.tiledb.iodoi.orgdspace.mit.eduen.wikipedia.orgen.wikiversity.orgepub.ub.uni-muenchen.deepubs.siam.orgexslt.orgfa.bianp.netfastavro.readthedocs.ioflake8.pycqa.orggcc.gnu.orggist.github.comgithub.comgitlab.comgitlab.freedesktop.orggoogle.comgraphics.stanford.edugroups.google.comhal.archives-ouvertes.frhal.inria.frhastie.su.domainshg.python.orghome.olemiss.eduhomepages.ecs.vuw.ac.nzhtml.spec.whatwg.orgi.stanford.eduieeexplore.ieee.orgimageio.readthedocs.ioinf.ufrgs.bripython.orgipython.readthedocs.ioj3-fortran.orgjmlr.csail.mit.edujmlr.orgjoblib.readthedocs.iojournals.plos.orgjs.cytoscape.orglib.stat.cmu.edulibsdl.orglink.springer.comlivelovely.comlvdmaaten.github.iomathworld.wolfram.commatplotlib.orgmedium.commesonbuild.commetacpan.orgmicrosoft.commitpress.mit.edumybinder.orgnarwhals-dev.github.ionbviewer.orgndownloader.figshare.comnicolas.limare.netnlp.stanford.edunumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnumpydoc.readthedocs.ioopensource.orgpackages.msys2.orgpages.cs.wisc.edupandas.pydata.orgpapers.nips.ccparquet.apache.orgpeople.cs.umass.edupeople.csail.mit.edupeople.eecs.berkeley.edupeople.iee.ihu.grpersonal.math.ubc.capillow.readthedocs.iopip.pypa.iopresbrey.mit.eduproceedings.neurips.ccprojecteuclid.orgpyinstaller.readthedocs.iopyperclip.readthedocs.iopypi.anaconda.orgpypi.orgpytest.orgraw.githack.comraw.githubusercontent.comrob.schapire.nets3-us-west-2.amazonaws.comschemas.microsoft.comscikit-image.orgscikit-learn.orgscipy-cookbook.readthedocs.ioscipy-lectures.orgseaborn.pydata.orgskops.readthedocs.iosourceware.orgsparse.pydata.orgspecs.frictionlessdata.iostackoverflow.comstat.uw.edustats.stackexchange.comstatweb.stanford.edusupport.sas.comtinyurl.comtminka.github.iotruststore.readthedocs.iotyping.python.orgusers.iems.northwestern.eduusers.jyu.fiutopia.duth.grvassarstats.netviews.scientific-python.orgvis-www.cs.umass.eduweb.archive.orgweb.stanford.eduwixtoolset.orgwrapdb.mesonbuild.comwww.ams.orgwww.bestofmedia.comwww.cl.cam.ac.ukwww.cs.cornell.eduwww.cs.princeton.eduwww.cs.sfu.cawww.cs.technion.ac.ilwww.cs.toronto.eduwww.cs.ucl.ac.ukwww.cs.waikato.ac.nzwww.csie.ntu.edu.twwww.data-publica.comwww.dbs.ifi.lmu.dewww.di.ens.frwww.ecma-international.orgwww.eecs.tufts.eduwww.fordfoundation.orgwww.gaussianprocess.orgwww.godbole.netwww.google.comwww.graphviz.orgwww.intel.comwww.isca-archive.orgwww.iucnredlist.orgwww.jmlr.orgwww.jstatsoft.orgwww.jstor.orgwww.mars.comwww.math.hmc.eduwww.mathjax.orgwww.mathworks.comwww.microsoft.comwww.miketipping.comwww.mit.eduwww.mitpressjournals.orgwww.mlpack.orgwww.ncbi.nlm.nih.govwww.oasis-open.orgwww.openblas.netwww.openml.orgwww.opm.govwww.picloud.comwww.python.orgwww.research.ibm.comwww.researchgate.netwww.robots.ox.ac.ukwww.sciencedirect.comwww.scipy.orgwww.scivision.devwww.sphinx-doc.orgwww.springer.comwww.sri.comwww.stat.berkeley.eduwww.stata.comwww.statsmodels.orgwww.stixfonts.orgwww.tandfonline.comwww.utstat.toronto.eduwww.w3.orgwww.xyz.eduwww.yhat.comxarray.pydata.orgxgboost.readthedocs.ioxlrd.readthedocs.iozarr.readthedocs.io

</> First-Party Code

first-party (java): jvm-packages/xgboost4j

java first-party
expand_more 3 low-confidence finding(s)
low env_fs production #b6a5f23a334a529c — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:63 
      String os = System.getProperty("os.name", "generic").toLowerCase(Locale.ENGLISH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f312d953026c7305 — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:101 
      String arch = System.getProperty("os.arch", "generic").toLowerCase(Locale.ENGLISH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ebc06d1d51269be — Environment-variable access.
repo/jvm-packages/xgboost4j/src/main/java/ml/dmlc/xgboost4j/java/NativeLibLoader.java:135 
      String libraryPath = System.getProperty(getPropertyNameForLibrary(libName));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (java): jvm-packages/xgboost4j-example

java first-party
expand_more 2 low-confidence finding(s)
low env_fs test-only #8e0e5414b9ab208c — Filesystem access.
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:48 
    FileInputStream in = new FileInputStream(f);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only #1de2aa1f7529d73e — Filesystem access.
repo/jvm-packages/xgboost4j-example/src/main/java/ml/dmlc/xgboost4j/java/example/util/DataLoader.java:91 
    FileInputStream in = new FileInputStream(f);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

com.esotericsoftware:kryo

java dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #ca86f8ce25a152ec — Environment-variable access.
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:38 
	public static final boolean isAndroid = "Dalvik".equals(System.getProperty("java.vm.name"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b4ef9b89b92cf49 — Environment-variable access.
pkgs/java/[email protected]/com/esotericsoftware/kryo/util/Util.java:44 
		if ("false".equals(System.getProperty("kryo.unsafe"))) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

commons-logging:commons-logging

java dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #51a74d2e288c8e26 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1016 
        return AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty(key, def));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7747ddf386bee6c1 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1193 
            logDiagnostic("[ENV] Extension directories (java.ext.dir): " + System.getProperty("java.ext.dir"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54b99cd2e8c67817 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogFactory.java:1194 
            logDiagnostic("[ENV] Application classpath (java.class.path): " + System.getProperty("java.class.path"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9942ba5b745e445b — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:88 
            name = System.getProperty("org.apache.commons.logging.log");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48eabca07c1ee437 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/LogSource.java:90 
                name = System.getProperty("org.apache.commons.logging.Log");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e5f23d5bf87d03e — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/impl/LogFactoryImpl.java:211 
        return AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty(key, def));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39111aa4bac0f152 — Environment-variable access.
pkgs/java/[email protected]/org/apache/commons/logging/impl/SimpleLog.java:216 
            prop = System.getProperty(name);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • scipy prod — sdist exceeds byte cap
  • nvidia-nccl-cu12 prod — no sdist (wheels only)
  • matplotlib prod — sdist exceeds byte cap
  • pyspark prod — sdist exceeds byte cap
  • org.scala-lang:scala-compiler prod — no sources jar (404)
  • org.scala-lang:scala-library prod — no sources jar (404)
  • org.scala-lang.modules:scala-collection-compat_${scala.binary.version} prod — no sources jar (404)
  • org.apache.hadoop:hadoop-common prod — no sources jar (404)
  • ml.dmlc:xgboost4j-spark_2.12 prod — no sources jar (404)
  • ml.dmlc:xgboost4j-flink_2.12 prod — no sources jar (404)
  • ml.dmlc:xgboost4j_2.12 prod — no sources jar (404)
  • org.apache.flink:flink-clients prod — no sources jar (404)