Close Open Privacy Scan

link https://github.com/FlowiseAI/Flowise
bolt Snapshot: commit ed9e100
science engine v1.21
schedule 2026-07-18T05:17:02.789678+00:00

verified_user Application data leak confirmed

High-confidence data exfiltration identified in application code.

smart_toy MCP server detected: @anthropic-ai/sdk, @google/generative-ai, @langchain/anthropic, @langchain/core +14 more — detected in dependencies, not a safety judgment.
Incomplete scan — only 105/200 dependencies were analyzed. Treat the score as provisional.

App Privacy Score

42 /100
High privacy risk — application leak confirmed

High risk · 3456 finding(s)

Dependency score: 0 (High risk)

bar_chart Score Breakdown

pii_flow −30
egress −15
telemetry −10
env_fs −3

list Scan Summary

3 high 18 medium 3435 low
First-party packages: 5
Dependency packages: 41
Ecosystem: npm

swap_horiz Confirmed data exfiltration in application code

External domains: aaa.nonexistanturl.comaccounts.google.comai.google.devairtable.comapi.airtable.comapi.anthropic.comapi.astra.datastax.comapi.cerebras.aiapi.cloudflare.comapi.cohere.aiapi.cometapi.comapi.dev.cloud.datastax.comapi.dicebear.comapi.elevenlabs.ioapi.eu.residency.elevenlabs.ioapi.firecrawl.devapi.fireworks.aiapi.github.comapi.githubcopilot.comapi.hub.langchain.comapi.in.residency.elevenlabs.ioapi.ipify.orgapi.jina.aiapi.lunary.aiapi.nodemailer.comapi.open-meteo.comapi.openai.comapi.pipedream.comapi.sambanova.aiapi.search.brave.comapi.sg.residency.elevenlabs.ioapi.smith.langchain.comapi.speak.comapi.spider.cloudapi.test.cloud.datastax.comapi.unstructuredapp.ioapi.us.elevenlabs.ioapi.vectara.ioapi.voyageai.comapify.comapp.langwatch.aiapp.mem0.aiapp.phoenix.arize.comarize.comarxiv.orgazure.microsoft.combit.lybrave.comcatalog.ngc.nvidia.comcdn.jsdelivr.netcloud.cerebras.aicloud.langfuse.comcommunity.atlassian.comconfluence.atlassian.comconsole.apify.comconsole.cloud.google.comconsole.groq.comconsole.mistral.aideveloper.wolframalpha.comdevelopers.notion.comdisk.compute.azure.comdocs.anthropic.comdocs.arize.comdocs.aws.amazon.comdocs.browserless.iodocs.bullmq.iodocs.cohere.comdocs.exa.aidocs.expo.devdocs.flowiseai.comdocs.getzep.comdocs.gitbook.comdocs.github.comdocs.google.comdocs.googleapis.comdocs.langwatch.aidocs.microsoft.comdocs.momentohq.comdocs.perplexity.aidocs.sambanova.aidocs.searxng.orgdocs.slack.devdocs.smith.langchain.comdocs.stripe.comdocs.teradata.comdocs.together.aidocs.unstructured.iodocs.vectara.comdocs.voyageai.comdrive.google.comdynamodb.amazonaws.comelevenlabs.ioethereal.emailexample.atlassian.netexport.arxiv.orgexpress-rate-limit.github.iofireworks.aiflowiseai.comgithub.comgmail.googleapis.comgraph.microsoft.comhandlebarsjs.comhelp.openai.comid.atlassian.comintegrate.api.nvidia.comip.nfriedly.comjina.aijs.langchain.comjson-schema.orglangfuse.comlangwatch.ailearn.microsoft.comlocalai.iologin.microsoftonline.comlunary.aimail.google.commakersuite.google.commcp-server-ab71a6b2-cd55-49d0-adba-562bc85956e3.supermachine.appmcp.browserless.iomcp.pipedream.commcp.slack.commeilisearch.commilvus.iomomentjs.comneo4j.comnodejs.orgnodemailer.comnpm.imnpms.ionts.ngc.nvidia.comoauth2.googleapis.comoctocorp.ghe.comopenidconnect.googleapis.comopenrouter.aiotlp.arize.comphoenix.arize.compipedream.complatform.claude.complatform.openai.composthog.comprogrammablesearchengine.google.compython.langchain.comqdrant.techraw.githubusercontent.comrealtime.oxylabs.ioremote.mcp.pipedream.netreplicate.coms3-fips.dualstacks3-fips.dualstack.us-east-1s3-fips.us-east-1s3.amazonaws.coms3.dualstacks3.dualstack.us-east-1sentry.iosetuptools.pypa.iosheets.googleapis.comsidorares.github.ioslack.comsmith.langchain.comsns.amazonaws.comsns.us-gov-east-1.amazonaws.comsns.us-gov-west-1.amazonaws.comspider.cloudstorage.azure.comstripe.comsts.amazonaws.comsupport.airtable.comsupport.atlassian.comts.llamaindex.aiunstructured-io.github.iounstructured.ioupstash.comus.i.posthog.comvectara.comwww.assemblyai.comwww.comet.comwww.elastic.cowww.figma.comwww.firecrawl.devwww.google.comwww.googleapis.comwww.notion.sowww.npmjs.comwww.searchapi.iowww.w3.orgwww.yahoo.comxyz.eu-west-1.aws.endpoints.huggingface.cloudyour-foundry-instance.services.ai.azure.com

high first-party (npm): packages/components A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent.
repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:129 → repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:132
hub Dependency data flows (14)
high axios dependency A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent.
pkgs/npm/[email protected]/lib/adapters/http.js:611 → pkgs/npm/[email protected]/lib/adapters/http.js:708
high flowise-components dependency A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent.
pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:129 → pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:132
medium axios dependency Credentials parsed from the request URL are applied as authorization on the same outbound HTTP request. This is intentional URL authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/lib/adapters/http.js:616 → pkgs/npm/[email protected]/lib/adapters/http.js:708
medium winston dependency Credentials parsed from the request URL are applied as authorization on the same outbound HTTP request. This is intentional URL authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/lib/winston/transports/http.js:249 → pkgs/npm/[email protected]/lib/winston/transports/http.js:242
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:39 → pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:42
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:36 → pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:39
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:91 → pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:94
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:55 → pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:58
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:80 → pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:83
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:92 → pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:95
medium winston-azure-blob tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/index.ts:19 → pkgs/npm/[email protected]__reposrc/examples/index.ts:33
medium @brave/brave-search-mcp-server dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/src/config.ts:77 → pkgs/npm/@[email protected]__reposrc/src/config.ts:135
medium @brave/brave-search-mcp-server dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/src/config.ts:77 → pkgs/npm/@[email protected]__reposrc/src/config.ts:142
medium @brave/brave-search-mcp-server dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/src/config.ts:77 → pkgs/npm/@[email protected]__reposrc/src/config.ts:157

</> First-Party Code

first-party (npm): packages/components

npm first-party
high pii_flow production #bc54727217a5a45d — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent.
repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:132 · flow /tmp/closeopen-1_0nwmaz/repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:129 → /tmp/closeopen-1_0nwmaz/repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:132 
        const response = await fetch(this.apiUrl, {
            method: 'POST',
            body: formData,
            headers
        })

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 362 low-confidence finding(s)
low egress production #93bda443fe70a187 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/evaluation/EvaluationRunner.ts:144 
                let response = await axios.post(`${this.baseURL}/api/v1/prediction/${chatflowId}`, postData, axiosConfig)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d8c7153c72fe97ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/agentflow/utils.ts:534 
        const response = await fetch(`https://api.openai.com/v1/containers/${containerId}/files/${fileId}/content`, {
            method: 'GET',
            headers: {
                Accept: '*/*',
                Authorization: `Bearer ${openAIApiKey}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #b12246bfd511c95e — Environment-variable access.
repo/packages/components/nodes/agents/ConversationalAgent/ConversationalAgent.ts:283 
        verbose: process.env.DEBUG === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #961b383ecb6a0eef — Environment-variable access.
repo/packages/components/nodes/agents/ConversationalRetrievalToolAgent/ConversationalRetrievalToolAgent.ts:360 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6689c1d20111222e — Environment-variable access.
repo/packages/components/nodes/agents/LlamaIndexAgents/AnthropicAgent/AnthropicAgent_LlamaIndex.ts:104 
            verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79d1af84fc884243 — Environment-variable access.
repo/packages/components/nodes/agents/LlamaIndexAgents/AnthropicAgent/AnthropicAgent_LlamaIndex.ts:113 
        const response = await agent.chat({ message: input, chatHistory, verbose: process.env.DEBUG === 'true' ? true : false })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f220238cd80d3e63 — Environment-variable access.
repo/packages/components/nodes/agents/LlamaIndexAgents/OpenAIToolAgent/OpenAIToolAgent_LlamaIndex.ts:115 
            verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b4912ea87517021c — Environment-variable access.
repo/packages/components/nodes/agents/LlamaIndexAgents/OpenAIToolAgent/OpenAIToolAgent_LlamaIndex.ts:130 
                verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #71ba9d712f5eca08 — Environment-variable access.
repo/packages/components/nodes/agents/LlamaIndexAgents/OpenAIToolAgent/OpenAIToolAgent_LlamaIndex.ts:157 
            const response = await agent.chat({ message: input, chatHistory, verbose: process.env.DEBUG === 'true' ? true : false })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #78bf6ac2ea106a00 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/agents/OpenAIAssistant/OpenAIAssistant.ts:974 
        const response = await fetch(`https://api.openai.com/v1/files/${fileObj.id}/content`, {
            method: 'GET',
            headers: { Accept: '*/*', Authorization: `Bearer ${openAIApiKey}` }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #8c4f1723b87aa7ac — Environment-variable access.
repo/packages/components/nodes/agents/ReActAgentChat/ReActAgentChat.ts:132 
            verbose: process.env.DEBUG === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e4185df41eed184 — Environment-variable access.
repo/packages/components/nodes/agents/ReActAgentLLM/ReActAgentLLM.ts:105 
            verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #521677b993cd2cc1 — Environment-variable access.
repo/packages/components/nodes/agents/ToolAgent/ToolAgent.ts:359 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8cc385490601b208 — Environment-variable access.
repo/packages/components/nodes/agents/XMLAgent/XMLAgent.ts:284 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #6d7f523baf745f42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/cache/RedisCache/RedisCache.ts:66 
            let value = await client.get(key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d0a43d906128cf5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/cache/RedisCache/RedisCache.ts:74 
                value = await client.get(key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #090ead819cdd7947 — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisCache.ts:130 
                process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9738c4be69457f0 — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisCache.ts:131 
                    ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69630f88a317ef0e — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisCache.ts:138 
                process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6c9c96064003892a — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisCache.ts:139 
                    ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dfe6029aa21ba728 — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:87 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6fc21c1de78eb75f — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:88 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a780a2893297cb83 — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:95 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c68823dbdf8cb9c4 — Environment-variable access.
repo/packages/components/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:96 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7de1f8fcefaab389 — Environment-variable access.
repo/packages/components/nodes/chains/ApiChain/GETApiChain.ts:134 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e3415a6d8fab4f90 — Environment-variable access.
repo/packages/components/nodes/chains/ApiChain/OpenAPIChain.ts:134 
        verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ec6562f7d6fe69e6 — Environment-variable access.
repo/packages/components/nodes/chains/ApiChain/POSTApiChain.ts:124 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6199515b2a6f057 — Environment-variable access.
repo/packages/components/nodes/chains/ConversationChain/ConversationChain.ts:139 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c31e23aad0b68b91 — Environment-variable access.
repo/packages/components/nodes/chains/ConversationalRetrievalQAChain/ConversationalRetrievalQAChain.ts:229 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b7581f0965da5e17 — Environment-variable access.
repo/packages/components/nodes/chains/GraphCypherQAChain/GraphCypherQAChain.ts:423 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #50080af9485e7572 — Environment-variable access.
repo/packages/components/nodes/chains/LLMChain/LLMChain.ts:109 
                verbose: process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #815662b245968285 — Environment-variable access.
repo/packages/components/nodes/chains/LLMChain/LLMChain.ts:117 
                verbose: process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64cbd755ddfadc48 — Environment-variable access.
repo/packages/components/nodes/chains/MultiPromptChain/MultiPromptChain.ts:71 
            llmChainOpts: { verbose: process.env.DEBUG === 'true' ? true : false }

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #226fa4f69e9c6b58 — Environment-variable access.
repo/packages/components/nodes/chains/MultiRetrievalQAChain/MultiRetrievalQAChain.ts:79 
            retrievalQAChainOpts: { verbose: process.env.DEBUG === 'true' ? true : false, returnSourceDocuments }

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4d96aa7743305c6e — Environment-variable access.
repo/packages/components/nodes/chains/RetrievalQAChain/RetrievalQAChain.ts:58 
        const chain = RetrievalQAChain.fromLLM(model, vectorStoreRetriever, { verbose: process.env.DEBUG === 'true' ? true : false })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0ccf4ae332343db — Environment-variable access.
repo/packages/components/nodes/chains/SqlDatabaseChain/SqlDatabaseChain.ts:245 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #054ac7437dcb192a — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/chains/VectaraChain/VectaraChain.ts:312 
            const response = await fetch(`https://api.vectara.io/v1/query`, {
                method: 'POST',
                headers: headers?.headers,
                body: JSON.stringify(data)
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #1814d82459a69f5c — Environment-variable access.
repo/packages/components/nodes/chains/VectorDBQAChain/VectorDBQAChain.ts:60 
            verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dd5ebb2e80e9600c — Filesystem access.
repo/packages/components/nodes/chatmodels/AWSBedrock/AWSBedrockCatalog.test.ts:1 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1a72e8eae5be37e6 — Filesystem access.
repo/packages/components/nodes/chatmodels/AWSBedrock/AWSBedrockCatalog.test.ts:9 
        const raw = JSON.parse(fs.readFileSync(modelsPath, 'utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #31f73d64bda284f4 — Environment-variable access.
repo/packages/components/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:10 
    !!process.env.AZURE_OPENAI_API_KEY &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3fe680b5392c5748 — Environment-variable access.
repo/packages/components/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:11 
    !!process.env.AZURE_OPENAI_API_INSTANCE_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe58717c8f466718 — Environment-variable access.
repo/packages/components/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:12 
    !!process.env.AZURE_OPENAI_API_DEPLOYMENT_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2a73de88f501086 — Environment-variable access.
repo/packages/components/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:13 
    !!process.env.AZURE_OPENAI_API_VERSION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #dfa7a35f4cac7444 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/chatmodels/ChatNemoGuardrails/NemoClient.ts:66 
        return await fetch(`${this.config.baseUrl}/v1/chat/completions`, requestOptions)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5a44852c8773935c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/Airtable/Airtable.ts:318 
            const response = await axios.post(url, data, { headers })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #421e406503e8c6d7 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Cheerio/Cheerio.ts:155 
                    if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #04a42885878e499f — Environment-variable access.
repo/packages/components/nodes/documentloaders/Cheerio/Cheerio.ts:177 
                if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bc96c7a0dc3fec1a — Environment-variable access.
repo/packages/components/nodes/documentloaders/Cheerio/Cheerio.ts:186 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Start CheerioWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4171add9abb430cc — Environment-variable access.
repo/packages/components/nodes/documentloaders/Cheerio/Cheerio.ts:197 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1200b7324a607484 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Cheerio/Cheerio.ts:203 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Finish CheerioWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #43702630a2c4843f — Environment-variable access.
repo/packages/components/nodes/documentloaders/Cheerio/Cheerio.ts:205 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1930d49a5f101113 — Filesystem access.
repo/packages/components/nodes/documentloaders/Epub/Epub.ts:7 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc70a8795a23eb2f — Filesystem access.
repo/packages/components/nodes/documentloaders/Epub/Epub.ts:127 
                    fs.writeFileSync(tempFilePath, fileData)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed610ced7879a400 — Filesystem access.
repo/packages/components/nodes/documentloaders/Epub/Epub.ts:139 
                    fs.writeFileSync(tempFilePath, fileBuffer)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #704ed18022a0e64f — Filesystem access.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:15 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #552c9f5a4dc347b5 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:227 
                const url = new URL('https://www.googleapis.com/drive/v3/files')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c3f822fcf94ee1eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:239 
                const response = await fetch(url.toString(), {
                    headers: {
                        Authorization: `Bearer ${accessToken}`,
                        'Content-Type': 'application/json'
                    }
                })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #bdecab1752fb08da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:412 
        const response = await fetch(url.toString(), {
            headers: {
                Authorization: `Bearer ${accessToken}`,
                'Content-Type': 'application/json'
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #151d3806b542a63b — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:454 
            const url = new URL('https://www.googleapis.com/drive/v3/files')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a31b20052c8a6f36 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:472 
            const response = await fetch(url.toString(), {
                headers: {
                    Authorization: `Bearer ${accessToken}`,
                    'Content-Type': 'application/json'
                }
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #4ceb60193250295a — Filesystem access.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:702 
        fs.writeFileSync(tempFilePath, buffer)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #e094d873f230ab4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:709 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f842ee56b30ea7a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:726 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #46cdb4cea7ca64ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:808 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #57b40928150d8331 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:155 
                const url = new URL('https://www.googleapis.com/drive/v3/files')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d8eb9281f2110c98 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:161 
                const response = await fetch(url.toString(), {
                    headers: {
                        Authorization: `Bearer ${accessToken}`,
                        'Content-Type': 'application/json'
                    }
                })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2a6e1157a58dcad1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:316 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`,
                'Content-Type': 'application/json'
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3f5d829bbedf68ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:339 
        const response = await fetch(`${url}?${params}`, {
            headers: {
                Authorization: `Bearer ${accessToken}`,
                'Content-Type': 'application/json'
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #02d7de147a122468 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Playwright/Playwright.ts:196 
                const executablePath = process.env.PLAYWRIGHT_EXECUTABLE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c8d5d43f3a55344d — Environment-variable access.
repo/packages/components/nodes/documentloaders/Playwright/Playwright.ts:263 
                if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9f4156587f6f1ce — Environment-variable access.
repo/packages/components/nodes/documentloaders/Playwright/Playwright.ts:270 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Start PlaywrightWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1098979c180dc7e2 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Playwright/Playwright.ts:281 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8e8ea2b80a6e229d — Environment-variable access.
repo/packages/components/nodes/documentloaders/Playwright/Playwright.ts:290 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Finish PlaywrightWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7b10186b2fce95db — Environment-variable access.
repo/packages/components/nodes/documentloaders/Playwright/Playwright.ts:292 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2d2daf38ac3c5842 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts:187 
                const executablePath = process.env.PUPPETEER_EXECUTABLE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5ba565c84bd4b50b — Environment-variable access.
repo/packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts:257 
                if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53315439d7311dec — Environment-variable access.
repo/packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts:264 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Start PuppeteerWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b6689b80a43757b7 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts:275 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12d62184b33cfc6e — Environment-variable access.
repo/packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts:284 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Finish PuppeteerWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d28bc08d92263064 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts:286 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39598c18a0b8075d — Filesystem access.
repo/packages/components/nodes/documentloaders/S3Directory/S3Directory.ts:217 
                        fsDefault.writeFileSync(filePath, objectData)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f23dda24d42a4ae5 — Environment-variable access.
repo/packages/components/nodes/documentloaders/S3File/S3File.ts:130 
                placeholder: process.env.UNSTRUCTURED_API_URL || 'http://localhost:8000/general/v0/general',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc699d07fb6c7215 — Environment-variable access.
repo/packages/components/nodes/documentloaders/S3File/S3File.ts:131 
                optional: !!process.env.UNSTRUCTURED_API_URL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d79b1829ff374151 — Filesystem access.
repo/packages/components/nodes/documentloaders/S3File/S3File.ts:784 
                    fsDefault.writeFileSync(filePath, objectData)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1bdc8e98bff02bb0 — Filesystem access.
repo/packages/components/nodes/documentloaders/S3File/S3File.ts:1020 
        fsDefault.writeFileSync(tempFilePath, buffer)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #946476f4c5062fdb — Environment-variable access.
repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:30 
    private apiUrl = process.env.UNSTRUCTURED_API_URL || 'https://api.unstructuredapp.io/general/v0/general'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8ae29f873a4fa900 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:32 
    private apiKey: string | undefined = process.env.UNSTRUCTURED_API_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #f157541e49c8e3f3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/documentloaders/Unstructured/Unstructured.ts:132 
        const response = await fetch(this.apiUrl, {
            method: 'POST',
            body: formData,
            headers
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #398c2391b2684e69 — Environment-variable access.
repo/packages/components/nodes/documentloaders/Unstructured/UnstructuredFile.ts:57 
                placeholder: process.env.UNSTRUCTURED_API_URL || 'http://localhost:8000/general/v0/general',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac3c74b34b40887b — Environment-variable access.
repo/packages/components/nodes/documentloaders/Unstructured/UnstructuredFile.ts:58 
                optional: !!process.env.UNSTRUCTURED_API_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #502e3f097ee63a57 — Environment-variable access.
repo/packages/components/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:6 
    !!process.env.AZURE_OPENAI_API_KEY &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9520cd00090557e1 — Environment-variable access.
repo/packages/components/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:7 
    !!process.env.AZURE_OPENAI_API_INSTANCE_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #08ca9b12c4564a25 — Environment-variable access.
repo/packages/components/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:8 
    (!!process.env.AZURE_OPENAI_API_EMBEDDINGS_DEPLOYMENT_NAME || !!process.env.AZURE_OPENAI_API_DEPLOYMENT_NAME) &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #38d1d255dd27cde7 — Environment-variable access.
repo/packages/components/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:9 
    !!process.env.AZURE_OPENAI_API_VERSION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #330f6465330dc4a0 — Environment-variable access.
repo/packages/components/nodes/llms/Azure OpenAI/AzureOpenAI.ts:9 
    !!process.env.AZURE_OPENAI_API_KEY &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0db6258150d4e54d — Environment-variable access.
repo/packages/components/nodes/llms/Azure OpenAI/AzureOpenAI.ts:10 
    !!process.env.AZURE_OPENAI_API_INSTANCE_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f5fe4cd348bf447 — Environment-variable access.
repo/packages/components/nodes/llms/Azure OpenAI/AzureOpenAI.ts:11 
    !!process.env.AZURE_OPENAI_API_DEPLOYMENT_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6eca378db7f36b04 — Environment-variable access.
repo/packages/components/nodes/llms/Azure OpenAI/AzureOpenAI.ts:12 
    !!process.env.AZURE_OPENAI_API_VERSION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ec6256527495f76d — Environment-variable access.
repo/packages/components/nodes/memory/AgentMemory/AgentMemory.ts:138 
                : path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c93aa86a8f243556 — Environment-variable access.
repo/packages/components/nodes/memory/AgentMemory/SQLiteAgentMemory/SQLiteAgentMemory.ts:72 
        const database = validateSQLitePath(path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6f0f0be5271a79e — Environment-variable access.
repo/packages/components/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:144 
                          process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2085c5e9e47c2f84 — Environment-variable access.
repo/packages/components/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:145 
                              ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #903e3e21c88b5097 — Environment-variable access.
repo/packages/components/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:151 
                          process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c4a65253eacf07f6 — Environment-variable access.
repo/packages/components/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:152 
                              ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2db889a8f100bffb — Environment-variable access.
repo/packages/components/nodes/multiagents/Worker/Worker.ts:235 
            verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19a722f3d748e90a — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts:10 
const serverCredentialsExists = !!process.env.POSTGRES_RECORDMANAGER_USER && !!process.env.POSTGRES_RECORDMANAGER_PASSWORD

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2a2f7444dcb92642 — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts:139 
        const user = getCredentialParam('user', credentialData, nodeData, process.env.POSTGRES_RECORDMANAGER_USER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e45061c2b06feb97 — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts:140 
        const password = getCredentialParam('password', credentialData, nodeData, process.env.POSTGRES_RECORDMANAGER_PASSWORD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21a02c30849ebca3 — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/utils.ts:4 
    return defaultChain(nodeData?.inputs?.host, process.env.POSTGRES_RECORDMANAGER_HOST)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d5333b465773631d — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/utils.ts:8 
    return defaultChain(nodeData?.inputs?.database, process.env.POSTGRES_RECORDMANAGER_DATABASE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ac7b5308db8ee369 — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/utils.ts:12 
    return defaultChain(nodeData?.inputs?.port, process.env.POSTGRES_RECORDMANAGER_PORT, '5432')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4fcca1fdb655ebc3 — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/utils.ts:16 
    return defaultChain(nodeData?.inputs?.ssl, process.env.POSTGRES_RECORDMANAGER_SSL, false)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #24c775a901d004a3 — Environment-variable access.
repo/packages/components/nodes/recordmanager/PostgresRecordManager/utils.ts:20 
    return defaultChain(nodeData?.inputs?.tableName, process.env.POSTGRES_RECORDMANAGER_TABLE_NAME, 'upsertion_records')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cf858415eb905565 — Environment-variable access.
repo/packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts:124 
        const database = validateSQLitePath(path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #76080ff6e2345f96 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/retrievers/CohereRerankRetriever/CohereRerank.ts:44 
            let returnedDocs = await axios.post(this.COHERE_API_URL, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #43bc088342b7a1a9 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/retrievers/JinaRerankRetriever/JinaRerank.ts:39 
            let returnedDocs = await axios.post(this.JINA_RERANK_API_URL, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #46ca441ebbfa2034 — Environment-variable access.
repo/packages/components/nodes/retrievers/MultiQueryRetriever/MultiQueryRetriever.ts:75 
            verbose: process.env.DEBUG === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #273049e781b56d97 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/retrievers/VoyageAIRetriever/VoyageAIRerank.ts:40 
            let returnedDocs = await axios.post(this.VOYAGEAI_RERANK_API_URL, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #f09f14a6f0ba40ec — Environment-variable access.
repo/packages/components/nodes/sequentialagents/Agent/Agent.ts:690 
            verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1f40d5c476e41c9 — Environment-variable access.
repo/packages/components/nodes/tools/Arxiv/Arxiv.ts:119 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #5858242508332801 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/Arxiv/core.ts:157 
        const response = await fetch(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c15963522b1f0c2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/Arxiv/core.ts:173 
        const response = await fetch(pdfUrl)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ec4d544ada55e13c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/Gmail/core.ts:86 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e00bad78d1c7bb08 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/GoogleCalendar/core.ts:160 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f2d94ec46abfc16c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/GoogleDocs/core.ts:118 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #330d6568ab79c6c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/GoogleDocs/core.ts:153 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9015a364f0c5baae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/GoogleDrive/core.ts:150 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? (typeof body === 'string' ? body : JSON.stringify(body)) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cf1b3516d8a7f922 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/GoogleDrive/core.ts:341 
        const response = await fetch(url, {
            method: 'POST',
            headers,
            body: params.content
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #512e0ae1d6d38262 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/GoogleDrive/core.ts:386 
            const response = await fetch(url, {
                method: 'POST',
                headers,
                body: body
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0000df67dda6146a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/GoogleSheets/core.ts:147 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #8e20dc9d41d106dd — Environment-variable access.
repo/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts:77 
                    process.env.CUSTOM_MCP_PROTOCOL === 'sse'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ddb1a2704f498e7 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts:176 
            if (process.env.CUSTOM_MCP_SECURITY_CHECK !== 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d64931b35ca3faf6 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts:186 
            if (process.env.CUSTOM_MCP_PROTOCOL === 'stdio' && serverParams!.command) toolkit = new MCPToolkit(serverParams, 'stdio')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #a97fb87262082669 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/MCP/Pipedream/PipedreamMCP.ts:51 
                const res = await client.request(req, CallToolResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e10daee612f8ca57 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/components/nodes/tools/MCP/Pipedream/PipedreamMCP.ts:212 
            const response = await axios.post('https://api.pipedream.com/v1/oauth/token', body, {
                headers: {
                    'Content-Type': 'application/json'
                }
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #1ec217360a774276 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/Supergateway/SupergatewayMCP.ts:109 
        if (process.env.CUSTOM_MCP_SECURITY_CHECK !== 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dfb6acbffca906d1 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:416 
        const originalAllowList = process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f69ba079cb33660b — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:420 
                delete process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1363bdd8c46e4c71 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:422 
                process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = originalAllowList

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #aaa01691f5334448 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:427 
            delete process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e2dc6d32ae07745a — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:435 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'API_KEY'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6982cad123ba2686 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:447 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'CUSTOM_VAR'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9d24447cf8eb0b66 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:455 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'CUSTOM_VAR,API_KEY'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fb14e7728766a170 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:464 
        const originalAllowedCommands = process.env.CUSTOM_MCP_ALLOWED_COMMANDS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ad6c717e26ebfa80 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:469 
            process.env.CUSTOM_MCP_ALLOWED_COMMANDS = 'node,npx,python,python3,docker'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3ca3f1dc294e4e9c — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:474 
                delete process.env.CUSTOM_MCP_ALLOWED_COMMANDS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4a49bdefaa03c15c — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:476 
                process.env.CUSTOM_MCP_ALLOWED_COMMANDS = originalAllowedCommands

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0b1bf66953296aea — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:536 
            const original = process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b863d3605ec84521 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:537 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'API_TOKEN'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #61f4d7b2f4c82a12 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:549 
                    delete process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c487a375f759dbb9 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:551 
                    process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = original

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0f628fe92de6b0ae — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:577 
                delete process.env.CUSTOM_MCP_ALLOWED_COMMANDS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0822abf7c43f0c1a — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:588 
                process.env.CUSTOM_MCP_ALLOWED_COMMANDS = 'python3'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7650f427aceba154 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:599 
                process.env.CUSTOM_MCP_ALLOWED_COMMANDS = 'npx,docker'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bf117642cecf007d — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.test.ts:610 
                process.env.CUSTOM_MCP_ALLOWED_COMMANDS = ' node , npx '

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3f25d48759a185f8 — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.ts:48 
                    PATH: process.env.PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #4b9d6a75649f2509 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/MCP/core.ts:110 
            this._tools = await this.client.request({ method: 'tools/list' }, ListToolsResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e9c454733489adc8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/MCP/core.ts:164 
                const res = await client.request(req, CallToolResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #6121344ce83bfb8b — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.ts:258 
        (process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e5547d76d1950bfe — Environment-variable access.
repo/packages/components/nodes/tools/MCP/core.ts:390 
    const allowedCommands = (process.env.CUSTOM_MCP_ALLOWED_COMMANDS ?? '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #b6e0126e9c4e9c15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/MicrosoftOutlook/core.ts:150 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1e4927a0afce048e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/tools/MicrosoftTeams/core.ts:37 
        const response = await fetch(`${BASE_URL}${endpoint}`, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2128381a9c5c87b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/nodes/vectorstores/Meilisearch/Meilisearch.ts:245 
            const response = await fetch(experimentalEndpoint, experimentalOptions)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #61c9671b0108eb3f — Environment-variable access.
repo/packages/components/nodes/vectorstores/Pinecone/Pinecone_LlamaIndex.ts:238 
        this.chunkSize = params?.chunkSize ?? Number.parseInt(process.env.PINECONE_CHUNK_SIZE ?? '100')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb7b22c8e668b279 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/Postgres.ts:13 
const serverCredentialsExists = !!process.env.POSTGRES_VECTORSTORE_USER && !!process.env.POSTGRES_VECTORSTORE_PASSWORD

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #592a7c7b2d42dcc2 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/driver/Base.ts:68 
        const user = getCredentialParam('user', credentialData, this.nodeData, process.env.POSTGRES_VECTORSTORE_USER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83ebfb6fc9e4fa7f — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/driver/Base.ts:69 
        const password = getCredentialParam('password', credentialData, this.nodeData, process.env.POSTGRES_VECTORSTORE_PASSWORD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da7429ccdce85a0c — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/utils.ts:4 
    return defaultChain(nodeData?.inputs?.host, process.env.POSTGRES_VECTORSTORE_HOST)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb9d543ec2ba2179 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/utils.ts:8 
    return defaultChain(nodeData?.inputs?.database, process.env.POSTGRES_VECTORSTORE_DATABASE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b5d76d394fa7d462 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/utils.ts:12 
    return defaultChain(nodeData?.inputs?.port, process.env.POSTGRES_VECTORSTORE_PORT, '5432')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #86b27a0964189769 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/utils.ts:16 
    return defaultChain(nodeData?.inputs?.ssl, process.env.POSTGRES_VECTORSTORE_SSL, false)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #57de5f11f7709056 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/utils.ts:20 
    return defaultChain(nodeData?.inputs?.tableName, process.env.POSTGRES_VECTORSTORE_TABLE_NAME, 'documents')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d89b5a3a3aba05c — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/utils.ts:24 
    return defaultChain(nodeData?.inputs?.contentColumnName, process.env.POSTGRES_VECTORSTORE_CONTENT_COLUMN_NAME, 'pageContent')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #384995c27704c554 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Postgres/utils.ts:28 
    return defaultChain(nodeData?.inputs?.schemaName, process.env.POSTGRES_VECTORSTORE_SCHEMA_NAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99d4418acf82f1bc — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:154 
                            process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad1bb70c43e02b5f — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:155 
                                ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #84bb2b454aabefa8 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:159 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f871a9e973f5676 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:160 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #858d88c3abafb8dc — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:172 
                    if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ae8bdb8adaacab45 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:231 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d75148079257f510 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:232 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #01760b7af1d00d07 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:236 
                process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6941f5d3ebf164a4 — Environment-variable access.
repo/packages/components/nodes/vectorstores/Redis/Redis.ts:237 
                    ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3a78d0736e5a8ced — Environment-variable access.
repo/packages/components/src/handler.test.ts:388 
        for (const k of LANGSMITH_KEYS) envSnapshot[k] = process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7a4daa8ab7ebb84d — Environment-variable access.
repo/packages/components/src/handler.test.ts:389 
        for (const k of LANGSMITH_KEYS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d458a3022ceae1a9 — Environment-variable access.
repo/packages/components/src/handler.test.ts:390 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9a9843c417ef9877 — Environment-variable access.
repo/packages/components/src/handler.test.ts:391 
        process.env.LANGSMITH_API_KEY = 'test-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #caaa3037e3104de4 — Environment-variable access.
repo/packages/components/src/handler.test.ts:397 
        for (const k of LANGSMITH_KEYS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e587d27b79a57ba2 — Environment-variable access.
repo/packages/components/src/handler.test.ts:400 
            if (v !== undefined) process.env[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #60d1ff81fd105192 — Environment-variable access.
repo/packages/components/src/handler.ts:81 
        if (process.env.DEBUG === 'true') console.error(`Error setting up Arize tracer: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b445344e8fdb1610 — Environment-variable access.
repo/packages/components/src/handler.ts:135 
        if (process.env.DEBUG === 'true') console.error(`Error setting up Phoenix tracer: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ebc69850ac9cfc6 — Environment-variable access.
repo/packages/components/src/handler.ts:179 
        if (process.env.DEBUG === 'true') console.error(`Error setting up Opik tracer: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb730a3a37a8ed6b — Environment-variable access.
repo/packages/components/src/httpSecurity.ts:36 
    const securityCheckEnabled = process.env.HTTP_SECURITY_CHECK !== 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bda0dfaf51245acd — Environment-variable access.
repo/packages/components/src/httpSecurity.ts:37 
    const httpDenyListString = process.env.HTTP_DENY_LIST

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #75b63c935f568fa1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/src/httpSecurity.ts:249 
        const response = await fetch(currentUrl, { ...currentInit, agent: () => agent })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #94242b5ad232f96d — Filesystem access.
repo/packages/components/src/modelLoader.ts:2 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c796ad666002eae3 — Environment-variable access.
repo/packages/components/src/modelLoader.ts:38 
        process.env.MODEL_LIST_CONFIG_JSON ?? 'https://raw.githubusercontent.com/FlowiseAI/Flowise/main/packages/components/models.json'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #05dea96ddb959c4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/src/modelLoader.ts:41 
            const resp = await axios.get(modelFile)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #bcec48c2bb333aaa — Filesystem access.
repo/packages/components/src/modelLoader.ts:48 
            const models = await fs.promises.readFile(modelFile, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #43177bf195d70f4b — Filesystem access.
repo/packages/components/src/modelLoader.ts:55 
        const models = await fs.promises.readFile(getModelsJSONPath(), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #f82fc95869b3259d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/src/speechToText.ts:96 
                    const response = await axios.post(`${baseUrl}?api-version=${apiVersion}`, formData, {
                        headers: {
                            'Ocp-Apim-Subscription-Key': credentialData.azureSubscriptionKey,
                            Accept: 'application/json'
                        }
                    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #e079ca56e2c327b8 — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:40 
        const connectionString = process.env.AZURE_BLOB_STORAGE_CONNECTION_STRING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e53d549431b817e1 — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:41 
        const accountName = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #142f6dafaac64822 — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:42 
        const accountKey = process.env.AZURE_BLOB_STORAGE_ACCOUNT_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #40dc8ab1f4412a75 — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:43 
        const containerName = process.env.AZURE_BLOB_STORAGE_CONTAINER_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fca5bd0ac46294ec — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:265 
        const connectionString = process.env.AZURE_BLOB_STORAGE_CONNECTION_STRING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f810f39918af94ea — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:276 
            storageConfig.accountName = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e942b2e78b808018 — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:277 
            storageConfig.accessKey = process.env.AZURE_BLOB_STORAGE_ACCOUNT_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6054c071d14f9f5c — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:285 
        const connectionString = process.env.AZURE_BLOB_STORAGE_CONNECTION_STRING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #00e152a13a73a929 — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:286 
        const accountName = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #84e95b581272b24e — Environment-variable access.
repo/packages/components/src/storage/AzureBlobStorageProvider.ts:287 
        const accountKey = process.env.AZURE_BLOB_STORAGE_ACCOUNT_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9655b495eb2eb677 — Environment-variable access.
repo/packages/components/src/storage/BaseStorageProvider.ts:63 
        const storagePath = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9abccff9d2a0009f — Environment-variable access.
repo/packages/components/src/storage/BaseStorageProvider.ts:64 
            ? path.join(process.env.BLOB_STORAGE_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2beabb835f1257ec — Environment-variable access.
repo/packages/components/src/storage/GCSStorageProvider.ts:32 
        const keyFilename = process.env.GOOGLE_CLOUD_STORAGE_CREDENTIAL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4023a3cd82a4b939 — Environment-variable access.
repo/packages/components/src/storage/GCSStorageProvider.ts:33 
        const projectId = process.env.GOOGLE_CLOUD_STORAGE_PROJ_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f36ed6fc09f0b5c — Environment-variable access.
repo/packages/components/src/storage/GCSStorageProvider.ts:34 
        const bucketName = process.env.GOOGLE_CLOUD_STORAGE_BUCKET_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a2331bed20a3a708 — Environment-variable access.
repo/packages/components/src/storage/GCSStorageProvider.ts:333 
                uniformBucketLevelAccess: Boolean(process.env.GOOGLE_CLOUD_UNIFORM_BUCKET_ACCESS) ?? true,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #130ab8434b6ab9d4 — Filesystem access.
repo/packages/components/src/storage/LocalStorageProvider.ts:1 
import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19b749c078bbe543 — Filesystem access.
repo/packages/components/src/storage/LocalStorageProvider.ts:40 
        fs.writeFileSync(filePath, bf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #70542f66a0e68dee — Filesystem access.
repo/packages/components/src/storage/LocalStorageProvider.ts:60 
        fs.writeFileSync(filePath, bf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b4577e6dfd927790 — Filesystem access.
repo/packages/components/src/storage/LocalStorageProvider.ts:74 
        fs.writeFileSync(filePath, bf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0d71f3303c290e42 — Filesystem access.
repo/packages/components/src/storage/LocalStorageProvider.ts:81 
        return fs.readFileSync(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b08223f198a114cb — Filesystem access.
repo/packages/components/src/storage/LocalStorageProvider.ts:88 
            return fs.readFileSync(fileInStorage)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da0eaec37265ad38 — Filesystem access.
repo/packages/components/src/storage/LocalStorageProvider.ts:114 
                    return fs.readFileSync(targetPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f3f73d43d43c1e0 — Environment-variable access.
repo/packages/components/src/storage/LocalStorageProvider.ts:344 
        return process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #851a55ef33f524db — Environment-variable access.
repo/packages/components/src/storage/LocalStorageProvider.ts:345 
            ? path.join(process.env.BLOB_STORAGE_PATH, 'uploads')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #418c23a739698190 — Environment-variable access.
repo/packages/components/src/storage/LocalStorageProvider.ts:350 
        return process.env.HOME || process.env.USERPROFILE || process.env.HOMEPATH || ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1cdfcc3644b83bf6 — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:34 
        const accessKeyId = process.env.S3_STORAGE_ACCESS_KEY_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3258f96d24422262 — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:35 
        const secretAccessKey = process.env.S3_STORAGE_SECRET_ACCESS_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8227a4c07c5e42ae — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:36 
        const region = process.env.S3_STORAGE_REGION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #81f5a727214971ec — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:37 
        const bucket = process.env.S3_STORAGE_BUCKET_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69d3d623ac32b115 — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:38 
        const customURL = process.env.S3_ENDPOINT_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dd7676e96ce8306d — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:39 
        const forcePathStyle = process.env.S3_FORCE_PATH_STYLE === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #88c69dec92663340 — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:65 
            region: process.env.S3_STORAGE_REGION,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #139ee90c39d6ca38 — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:66 
            endpoint: process.env.S3_ENDPOINT_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d26d42afe92bc212 — Environment-variable access.
repo/packages/components/src/storage/S3StorageProvider.ts:528 
            const instance = process.env.HOSTNAME || process.env.POD_NAME || String(process.pid)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4a480e423e36b8b8 — Environment-variable access.
repo/packages/components/src/storage/StorageProviderFactory.ts:20 
            const storageType = process.env.STORAGE_TYPE || 'local'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a9a5ee62e61710d — Filesystem access.
repo/packages/components/src/storageUtils.ts:1 
import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7608106ae786cb7c — Environment-variable access.
repo/packages/components/src/storageUtils.ts:51 
    const storagePath = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #92020669ebbf872b — Environment-variable access.
repo/packages/components/src/storageUtils.ts:52 
        ? path.join(process.env.BLOB_STORAGE_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #154565de64e21ee3 — Environment-variable access.
repo/packages/components/src/storageUtils.ts:64 
    return process.env.STORAGE_TYPE ? process.env.STORAGE_TYPE : 'local'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e10a7ab2fd1726d7 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:21 
    for (const k of ENV_KEYS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5da88ee3397956a3 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:28 
    for (const k of ENV_KEYS) envSnapshot[k] = process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c4d750e84d95683a — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:37 
        if (v !== undefined) process.env[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #59afa725cdc170a7 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:48 
        process.env.LANGSMITH_TRACING = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d42f28ffbaf11415 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:49 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e49b0945ec330d4b — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:52 
        process.env.LANGSMITH_TRACING = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ec2cbb80898c69d0 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:55 
        process.env.LANGSMITH_TRACING = 'TRUE'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1ba6b30970d8616a — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:60 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #57c488fc5d28255a — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:65 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #860a04ae14ae375a — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:66 
        process.env.LANGSMITH_API_KEY = 'new-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a47c8338791cb0a — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:75 
        process.env.LANGCHAIN_TRACING_V2 = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #305e72d8a421b64f — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:76 
        process.env.LANGCHAIN_API_KEY = 'legacy-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #19291201d1b1b388 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:77 
        process.env.LANGCHAIN_ENDPOINT = 'https://legacy.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #82e3ba5cb57e8c16 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:78 
        process.env.LANGCHAIN_PROJECT = 'legacy-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #285538eff9e18221 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:87 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #19d23ca25350307d — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:88 
        process.env.LANGCHAIN_TRACING_V2 = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c4462e57cd5909dc — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:89 
        process.env.LANGSMITH_API_KEY = 'new-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #55a09a50a4ed69fc — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:90 
        process.env.LANGCHAIN_API_KEY = 'legacy-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f371f8a55ff3e5df — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:91 
        process.env.LANGSMITH_ENDPOINT = 'https://new.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f5881f5b932e9f05 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:92 
        process.env.LANGCHAIN_ENDPOINT = 'https://legacy.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #28ed3e756409b045 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:93 
        process.env.LANGSMITH_PROJECT = 'new-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f494b4a529348d03 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:94 
        process.env.LANGCHAIN_PROJECT = 'legacy-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f51a84161a31132e — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:103 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fc855d1a50eaeb0f — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:104 
        process.env.LANGCHAIN_API_KEY = 'legacy-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c1c8808b4c44657e — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:113 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1ea70b0ee248d7b9 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:114 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b8d87fed88ae9ecc — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:115 
        process.env.LANGSMITH_ENDPOINT = 'https://api.smith.langchain.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bc9e85c20963a8b6 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:116 
        process.env.LANGSMITH_PROJECT = 'my-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a185d6400b4a029 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:129 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a80979df869fe265 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:130 
        process.env.LANGSMITH_API_KEY = 'k1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ff680c2d59c0f9f3 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:135 
        process.env.LANGSMITH_API_KEY = 'k2'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5acb02bf75b3e32b — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:144 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cde6db608e3c6bfe — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:145 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3157cb7e3034acec — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:152 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b5b1c0ad1df98f82 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:153 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #000d94d00908d9bc — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:197 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fb64e0c49f8bc49d — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:198 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7843920a517bf0de — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:212 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d0b5718ff2a39e8b — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:213 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8128d61fd79ef1da — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:214 
        process.env.LANGSMITH_ENDPOINT = 'https://e.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #04bf8748afb8f96c — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:215 
        process.env.LANGSMITH_PROJECT = 'proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #acd4142c755bae3e — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:233 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f01b281ff8565c69 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:234 
        process.env.LANGSMITH_API_KEY = 'env-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ae5cdcfd87b4e888 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:245 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ed6ff17ad66931d9 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:246 
        process.env.LANGSMITH_API_KEY = 'env-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #edcfc1a4acc0a2fd — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:259 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b9dce1b2bd01b913 — Environment-variable access.
repo/packages/components/src/tracingEnv.test.ts:260 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e738de693cd5d02f — Environment-variable access.
repo/packages/components/src/tracingEnv.ts:71 
    for (const k of LANGCHAIN_TRACING_FLAG_VARS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d771f1912b6de38d — Environment-variable access.
repo/packages/components/src/utils.test.ts:245 
        delete process.env.ALLOW_BUILTIN_DEP

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4ce2d5e44ca79323 — Environment-variable access.
repo/packages/components/src/utils.test.ts:246 
        delete process.env.TOOL_FUNCTION_EXTERNAL_DEP

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1c6885fbd8202a1b — Environment-variable access.
repo/packages/components/src/utils.test.ts:251 
            process.env.ALLOW_BUILTIN_DEP = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #38c80cc0c2e7d842 — Environment-variable access.
repo/packages/components/src/utils.test.ts:278 
        process.env.ALLOW_BUILTIN_DEP = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #787a3a865163f116 — Environment-variable access.
repo/packages/components/src/utils.test.ts:284 
        process.env.ALLOW_BUILTIN_DEP = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ec339ad8222f5974 — Environment-variable access.
repo/packages/components/src/utils.test.ts:285 
        process.env.TOOL_FUNCTION_EXTERNAL_DEP = 'pg'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef6b006931a24eb8 — Filesystem access.
repo/packages/components/src/utils.ts:12 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fcf8941e0fb7a88a — Environment-variable access.
repo/packages/components/src/utils.ts:32 
const USE_AWS_SECRETS_MANAGER = process.env.SECRETKEY_STORAGE_TYPE === 'aws'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07c9e184d656ffe5 — Environment-variable access.
repo/packages/components/src/utils.ts:34 
    const region = process.env.SECRETKEY_AWS_REGION || 'us-east-1' // Default region if not provided

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ef57c33556162be4 — Environment-variable access.
repo/packages/components/src/utils.ts:35 
    const accessKeyId = process.env.SECRETKEY_AWS_ACCESS_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c09c8b5aa4351463 — Environment-variable access.
repo/packages/components/src/utils.ts:36 
    const secretAccessKey = process.env.SECRETKEY_AWS_SECRET_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #440f437f3fcd82e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/src/utils.ts:361 
        const response = await axios.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #73b233d6ae0cc5aa — Environment-variable access.
repo/packages/components/src/utils.ts:408 
            if (process.env.DEBUG === 'true') console.error(`error with scraped URL: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d4620f0d3dc461a6 — Environment-variable access.
repo/packages/components/src/utils.ts:454 
    if (process.env.DEBUG === 'true') console.info(`actively crawling ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc51188ec4122ffa — Environment-variable access.
repo/packages/components/src/utils.ts:459 
            if (process.env.DEBUG === 'true') console.error(`error in fetch with status code: ${resp.status}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f0186432a8c29ff — Environment-variable access.
repo/packages/components/src/utils.ts:465 
            if (process.env.DEBUG === 'true') console.error(`non html response, content type: ${contentType}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #400a5d31695cf051 — Environment-variable access.
repo/packages/components/src/utils.ts:475 
        if (process.env.DEBUG === 'true') console.error(`error in fetch url: ${err.message}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab6a442112989eb7 — Environment-variable access.
repo/packages/components/src/utils.ts:510 
    if (process.env.DEBUG === 'true') console.info(`actively scarping ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0bacb637492dd27b — Environment-variable access.
repo/packages/components/src/utils.ts:515 
            if (process.env.DEBUG === 'true') console.error(`error in fetch with status code: ${resp.status}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #180567aac5dbfb80 — Environment-variable access.
repo/packages/components/src/utils.ts:521 
            if (process.env.DEBUG === 'true') console.error(`non xml response, content type: ${contentType}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06f01d9c1cd61df1 — Environment-variable access.
repo/packages/components/src/utils.ts:528 
        if (process.env.DEBUG === 'true') console.error(`error in fetch url: ${err.message}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6688b4025fe460f2 — Environment-variable access.
repo/packages/components/src/utils.ts:540 
        return typeof process !== 'undefined' ? process.env?.[name] : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #17f2ecbf735e156a — Environment-variable access.
repo/packages/components/src/utils.ts:571 
    return process.env.SECRETKEY_PATH ? path.join(process.env.SECRETKEY_PATH, 'encryption.key') : getEncryptionKeyFilePath()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f05d9724722a0e74 — Environment-variable access.
repo/packages/components/src/utils.ts:579 
    if (process.env.FLOWISE_SECRETKEY_OVERWRITE !== undefined && process.env.FLOWISE_SECRETKEY_OVERWRITE !== '') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0071ac01b30bbf12 — Environment-variable access.
repo/packages/components/src/utils.ts:580 
        return process.env.FLOWISE_SECRETKEY_OVERWRITE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9266d2f07bb3de23 — Environment-variable access.
repo/packages/components/src/utils.ts:584 
            const secretId = process.env.SECRETKEY_AWS_NAME || 'FlowiseEncryptionKey'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8946f089b3c7c1ee — Filesystem access.
repo/packages/components/src/utils.ts:592 
        return await fs.promises.readFile(getEncryptionKeyPath(), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9f40dbc28c09a96 — Environment-variable access.
repo/packages/components/src/utils.ts:734 
    if (process.env[variableName] === undefined) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23890aed2e6db54c — Environment-variable access.
repo/packages/components/src/utils.ts:738 
    return process.env[variableName] as string

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #738833d5e7653748 — Environment-variable access.
repo/packages/components/src/utils.ts:1021 
                value = process.env[item.name] ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9fb647aabf031d0f — Filesystem access.
repo/packages/components/src/utils.ts:1048 
            const content = await fs.promises.readFile(checkPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #70fce2723311e5c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/components/src/utils.ts:1472 
                const refreshResponse = await fetch(
                    `${options.baseURL || 'http://localhost:3000'}/api/v1/oauth2-credential/refresh/${credentialId}`,
                    {
                        method: 'POST',
                        headers: {
                            'Content-Type': 'application/json'
                        }
                    }
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #8b941b82d2b066b6 — Environment-variable access.
repo/packages/components/src/utils.ts:1603 
    const shouldUseE2BSandbox = useSandbox && process.env.E2B_APIKEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5f821962d474c6f5 — Environment-variable access.
repo/packages/components/src/utils.ts:1606 
    if (process.env.SANDBOX_TIMEOUT) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6f9e245c48b92fd3 — Environment-variable access.
repo/packages/components/src/utils.ts:1607 
        timeoutMs = parseInt(process.env.SANDBOX_TIMEOUT, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f58a2c4d310d2630 — Environment-variable access.
repo/packages/components/src/utils.ts:1665 
            const sbx = await Sandbox.create({ apiKey: process.env.E2B_APIKEY, timeoutMs })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b5fd4ed5d265d889 — Environment-variable access.
repo/packages/components/src/utils.ts:1729 
        const builtinDeps = process.env.TOOL_FUNCTION_BUILTIN_DEP

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6128d34798982a91 — Environment-variable access.
repo/packages/components/src/utils.ts:1730 
            ? defaultAllowBuiltInDep.concat(process.env.TOOL_FUNCTION_BUILTIN_DEP.split(','))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5df0ba6488584472 — Environment-variable access.
repo/packages/components/src/utils.ts:1732 
        const externalDeps = process.env.TOOL_FUNCTION_EXTERNAL_DEP ? process.env.TOOL_FUNCTION_EXTERNAL_DEP.split(',') : []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #32c301f4056dc684 — Environment-variable access.
repo/packages/components/src/utils.ts:1733 
        let deps = process.env.ALLOW_BUILTIN_DEP === 'true' ? availableDependencies.concat(externalDeps) : externalDeps

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1da7bc41c6fd9494 — Environment-variable access.
repo/packages/components/src/validator.test.ts:55 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1c11a9258f76e04f — Environment-variable access.
repo/packages/components/src/validator.test.ts:58 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7563de4f800f7ef0 — Environment-variable access.
repo/packages/components/src/validator.test.ts:75 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2be8863ddce0a903 — Environment-variable access.
repo/packages/components/src/validator.test.ts:78 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e4218071b1704e95 — Environment-variable access.
repo/packages/components/src/validator.test.ts:365 
            const originalEnv = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1359ee2bb5454704 — Environment-variable access.
repo/packages/components/src/validator.test.ts:366 
            delete process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #93524eeb0c833399 — Environment-variable access.
repo/packages/components/src/validator.test.ts:375 
                    process.env.BLOB_STORAGE_PATH = originalEnv

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e80bd5c9823356f1 — Environment-variable access.
repo/packages/components/src/validator.test.ts:396 
        const originalEnv = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9cd759493a7c1bb7 — Environment-variable access.
repo/packages/components/src/validator.test.ts:401 
                process.env.BLOB_STORAGE_PATH = originalEnv

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0d4e778ad5aaa9e2 — Environment-variable access.
repo/packages/components/src/validator.test.ts:403 
                delete process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a887602713abb540 — Environment-variable access.
repo/packages/components/src/validator.test.ts:409 
            process.env.BLOB_STORAGE_PATH = customStoragePath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #60dd9a523f1c9ebd — Environment-variable access.
repo/packages/components/src/validator.test.ts:418 
            process.env.BLOB_STORAGE_PATH = path.join(userHome, 'custom-storage')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #298f82a03fb1e603 — Environment-variable access.
repo/packages/components/src/validator.test.ts:453 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #df4307fb4a4ccc71 — Environment-variable access.
repo/packages/components/src/validator.test.ts:456 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c8afb93c811af7b1 — Environment-variable access.
repo/packages/components/src/validator.test.ts:591 
        const originalDatabasePath = process.env.DATABASE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #83a1828e8fa9b4b6 — Environment-variable access.
repo/packages/components/src/validator.test.ts:595 
                delete process.env.DATABASE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #37c9d06e23d57658 — Environment-variable access.
repo/packages/components/src/validator.test.ts:597 
                process.env.DATABASE_PATH = originalDatabasePath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cd4c4b1c3eb05914 — Environment-variable access.
repo/packages/components/src/validator.test.ts:603 
            process.env.DATABASE_PATH = customBase

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f1d278b826bd2299 — Environment-variable access.
repo/packages/components/src/validator.test.ts:609 
            process.env.DATABASE_PATH = path.join(userHome, 'custom-flowise-data')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #887f1254bb74d93c — Environment-variable access.
repo/packages/components/src/validator.test.ts:616 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #02ba853eceb15c60 — Environment-variable access.
repo/packages/components/src/validator.test.ts:619 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3bd2509fce02aba1 — Environment-variable access.
repo/packages/components/src/validator.test.ts:788 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e37e4791ce8fa11b — Environment-variable access.
repo/packages/components/src/validator.test.ts:791 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4430d0019604a57 — Environment-variable access.
repo/packages/components/src/validator.ts:41 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9381eaa1a21ea13e — Environment-variable access.
repo/packages/components/src/validator.ts:70 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #31797c7c7dc64d4c — Environment-variable access.
repo/packages/components/src/validator.ts:195 
    if (process.env.BLOB_STORAGE_PATH) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad0287224c9d96a6 — Environment-variable access.
repo/packages/components/src/validator.ts:196 
        allowedDirs.push(path.resolve(process.env.BLOB_STORAGE_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a6cbf46f1030edc7 — Environment-variable access.
repo/packages/components/src/validator.ts:213 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #223dd788f5d5483c — Environment-variable access.
repo/packages/components/src/validator.ts:290 
    if (process.env.DATABASE_PATH) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #50cf3cf7a6d23152 — Environment-variable access.
repo/packages/components/src/validator.ts:291 
        dirs.push(path.resolve(process.env.DATABASE_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #de3e7b4b7b9ac480 — Environment-variable access.
repo/packages/components/src/validator.ts:324 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12d264c62444f4ee — Environment-variable access.
repo/packages/components/src/validator.ts:423 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (npm): packages/server

npm first-party
medium telemetry test-only Excluded from app score #a9f31710f145c851 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/packages/server/src/utils/telemetry.test.ts:36 
const posthogNode = require('posthog-node')

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry production #bd24c987b45946e3 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
repo/packages/server/src/utils/telemetry.ts:2 
import { PostHog } from 'posthog-node'

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 470 low-confidence finding(s)
low env_fs production #f9fba49128e51446 — Environment-variable access.
repo/packages/server/bin/dev:9 
process.env.NODE_ENV = 'development'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a9f53f26ef86cba2 — Environment-variable access.
repo/packages/server/src/AppConfig.ts:2 
    showCommunityNodes: process.env.SHOW_COMMUNITY_NODES ? process.env.SHOW_COMMUNITY_NODES.toLowerCase() === 'true' : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #64f63a38165199b1 — Environment-variable access.
repo/packages/server/src/CachePool.ts:15 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3ae9306654ab431c — Environment-variable access.
repo/packages/server/src/CachePool.ts:16 
            if (process.env.REDIS_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #19ba0c02acf7b197 — Environment-variable access.
repo/packages/server/src/CachePool.ts:17 
                this.redisClient = new Redis(process.env.REDIS_URL, {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #666053e02fbd7363 — Environment-variable access.
repo/packages/server/src/CachePool.ts:19 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93a5b08ca95f8538 — Environment-variable access.
repo/packages/server/src/CachePool.ts:20 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f7b367322b64e2c — Environment-variable access.
repo/packages/server/src/CachePool.ts:25 
                    host: process.env.REDIS_HOST || 'localhost',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #610d6caa0dbda79e — Environment-variable access.
repo/packages/server/src/CachePool.ts:26 
                    port: parseInt(process.env.REDIS_PORT || '6379'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1aac7dcb5ba18005 — Environment-variable access.
repo/packages/server/src/CachePool.ts:27 
                    username: process.env.REDIS_USERNAME || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e4d376abb1443289 — Environment-variable access.
repo/packages/server/src/CachePool.ts:28 
                    password: process.env.REDIS_PASSWORD || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb617a36e8204a52 — Environment-variable access.
repo/packages/server/src/CachePool.ts:30 
                        process.env.REDIS_TLS === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #498d78008ca987d0 — Environment-variable access.
repo/packages/server/src/CachePool.ts:32 
                                  cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f5b814d07ca54fa0 — Environment-variable access.
repo/packages/server/src/CachePool.ts:33 
                                  key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0a02413fd8a5a8c4 — Environment-variable access.
repo/packages/server/src/CachePool.ts:34 
                                  ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #36e3a6fa3befe4ef — Environment-variable access.
repo/packages/server/src/CachePool.ts:38 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09839cfbd715976e — Environment-variable access.
repo/packages/server/src/CachePool.ts:39 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb9ac1228888d95c — Environment-variable access.
repo/packages/server/src/CachePool.ts:52 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3002a4ab8e05fd71 — Environment-variable access.
repo/packages/server/src/CachePool.ts:63 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #044ed4f3c098d4d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/CachePool.ts:65 
                const serializedValue = await this.redisClient.get(`ssoTokenCache:${ssoToken}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #97bd7cce4f08c6eb — Environment-variable access.
repo/packages/server/src/CachePool.ts:77 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ced45b641c9af716 — Environment-variable access.
repo/packages/server/src/CachePool.ts:92 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #01e0663da2ae3b9d — Environment-variable access.
repo/packages/server/src/CachePool.ts:108 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97e29b6d0c9dc321 — Environment-variable access.
repo/packages/server/src/CachePool.ts:125 
        if (process.env.MODE !== MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d908122cd093f2b4 — Environment-variable access.
repo/packages/server/src/CachePool.ts:135 
        if (process.env.MODE !== MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f8a2c041860f7fd2 — Environment-variable access.
repo/packages/server/src/CachePool.ts:146 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #d99cc921332aff99 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/CachePool.ts:148 
                const serializedValue = await this.redisClient.get(`llmCache:${chatflowid}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #624991b97c4a93a8 — Environment-variable access.
repo/packages/server/src/CachePool.ts:164 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #babb87c2d759dd2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/CachePool.ts:166 
                const serializedValue = await this.redisClient.get(`embeddingCache:${chatflowid}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #9edb99e3cd4bc0c5 — Filesystem access.
repo/packages/server/src/DataSource.ts:3 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4636ec3efd6e1015 — Environment-variable access.
repo/packages/server/src/DataSource.ts:21 
    switch (process.env.DATABASE_TYPE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b1cc23912118f1a4 — Environment-variable access.
repo/packages/server/src/DataSource.ts:23 
            homePath = process.env.DATABASE_PATH ?? flowisePath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0b916f9b698ce23f — Environment-variable access.
repo/packages/server/src/DataSource.ts:36 
                host: process.env.DATABASE_HOST,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f5afb0f4a1431de — Environment-variable access.
repo/packages/server/src/DataSource.ts:37 
                port: parseInt(process.env.DATABASE_PORT || '3306'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bbca5bd128088abf — Environment-variable access.
repo/packages/server/src/DataSource.ts:38 
                username: process.env.DATABASE_USER,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #191f33a5c7f8a0f7 — Environment-variable access.
repo/packages/server/src/DataSource.ts:39 
                password: process.env.DATABASE_PASSWORD,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0e279346ee3f752b — Environment-variable access.
repo/packages/server/src/DataSource.ts:40 
                database: process.env.DATABASE_NAME,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1e8e4dc83992067 — Environment-variable access.
repo/packages/server/src/DataSource.ts:52 
                host: process.env.DATABASE_HOST,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fb6fb34478f44d64 — Environment-variable access.
repo/packages/server/src/DataSource.ts:53 
                port: parseInt(process.env.DATABASE_PORT || '3306'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bccea69f38c90bd7 — Environment-variable access.
repo/packages/server/src/DataSource.ts:54 
                username: process.env.DATABASE_USER,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #451f4a98dede6560 — Environment-variable access.
repo/packages/server/src/DataSource.ts:55 
                password: process.env.DATABASE_PASSWORD,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #164490d7cbd7283c — Environment-variable access.
repo/packages/server/src/DataSource.ts:56 
                database: process.env.DATABASE_NAME,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #396a381570d2691b — Environment-variable access.
repo/packages/server/src/DataSource.ts:68 
                host: process.env.DATABASE_HOST,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e923eb581f8a414f — Environment-variable access.
repo/packages/server/src/DataSource.ts:69 
                port: parseInt(process.env.DATABASE_PORT || '5432'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #080d276db1c45416 — Environment-variable access.
repo/packages/server/src/DataSource.ts:70 
                username: process.env.DATABASE_USER,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4584444f75d787ee — Environment-variable access.
repo/packages/server/src/DataSource.ts:71 
                password: process.env.DATABASE_PASSWORD,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8f35a5302dfc9572 — Environment-variable access.
repo/packages/server/src/DataSource.ts:72 
                database: process.env.DATABASE_NAME,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7fb681c395cb0656 — Environment-variable access.
repo/packages/server/src/DataSource.ts:91 
            homePath = process.env.DATABASE_PATH ?? flowisePath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e603b93a99a9b891 — Environment-variable access.
repo/packages/server/src/DataSource.ts:112 
    if (process.env.DATABASE_SSL_KEY_BASE64) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #96a029f7f542a59f — Environment-variable access.
repo/packages/server/src/DataSource.ts:114 
            rejectUnauthorized: process.env.DATABASE_REJECT_UNAUTHORIZED === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8bed2ac678b7aa21 — Environment-variable access.
repo/packages/server/src/DataSource.ts:115 
            ca: Buffer.from(process.env.DATABASE_SSL_KEY_BASE64, 'base64')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f1f6f01dd63b45fe — Environment-variable access.
repo/packages/server/src/DataSource.ts:117 
    } else if (process.env.DATABASE_SSL === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eda3f1db8d7f247b — Filesystem access.
repo/packages/server/src/IdentityManager.ts:15 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e04c9dbcbdb8330d — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:60 
        if (process.env.STRIPE_SECRET_KEY) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #455ce25f12737d88 — Filesystem access.
repo/packages/server/src/IdentityManager.ts:91 
            const publicKey = fs.readFileSync(path.join(__dirname, '../', 'src/enterprise/license/public.pem'), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed63e7ff31fcde41 — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:103 
        const LICENSE_URL = process.env.LICENSE_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2910efc0818b43e8 — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:104 
        const FLOWISE_EE_LICENSE_KEY = process.env.FLOWISE_EE_LICENSE_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99b930192179c1da — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:114 
            if (process.env.OFFLINE === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #654f96799cbbb076 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/IdentityManager.ts:140 
                    const response = await axios.post(`${LICENSE_URL}/enterprise/verify`, { license: FLOWISE_EE_LICENSE_KEY })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #b2eea0864225d3da — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:402 
                (item) => (item.price.product as string) === process.env.ADDITIONAL_SEAT_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #99d5dfec4ea997ba — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:419 
                newPlanId === process.env.CLOUD_FREE_ID ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c9c9b3a542afe670 — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:420 
                newPlanId === process.env.CLOUD_STARTER_ID ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10f91fd0e57c45d5 — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:421 
                newPlanId === process.env.CLOUD_PRO_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7104fb8c41c00de2 — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:435 
                newPlanId === process.env.CLOUD_FREE_ID ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #758c68947ce1fb0c — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:436 
                newPlanId === process.env.CLOUD_STARTER_ID ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #407191651bbafc6d — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:437 
                newPlanId === process.env.CLOUD_PRO_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d4704dc1a082a92 — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:493 
                    productId = process.env.CLOUD_STARTER_ID as string

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #17ed9695b2f6e75c — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:496 
                    productId = process.env.CLOUD_PRO_ID as string

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #514f1034465f6271 — Environment-variable access.
repo/packages/server/src/IdentityManager.ts:499 
                    productId = process.env.CLOUD_FREE_ID as string

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a37657359c103289 — Filesystem access.
repo/packages/server/src/NodesPool.ts:3 
import { Dirent } from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #912b1bcba829b647 — Filesystem access.
repo/packages/server/src/NodesPool.ts:5 
import { promises } from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #50bd2d3fb2f6263c — Environment-variable access.
repo/packages/server/src/NodesPool.ts:37 
        const disabled_nodes = process.env.DISABLED_NODES ? process.env.DISABLED_NODES.split(',') : []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #05efd894c2b27165 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:21 
        if (!this.stripe && process.env.STRIPE_SECRET_KEY) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad19fe88d8c256eb — Environment-variable access.
repo/packages/server/src/StripeManager.ts:22 
            this.stripe = new Stripe(process.env.STRIPE_SECRET_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d92ccc0247838251 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:140 
                return_url: `${process.env.APP_URL}/account`

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5fe034773d909c43 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:166 
                product: process.env.CLOUD_STARTER_ID as string,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c2eeb354bde5abd5 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:170 
                product: process.env.CLOUD_PRO_ID as string,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #00e6a66fcb63b54e — Environment-variable access.
repo/packages/server/src/StripeManager.ts:174 
                product: process.env.CLOUD_FREE_ID as string,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37a6510a6e8989ff — Environment-variable access.
repo/packages/server/src/StripeManager.ts:178 
                product: process.env.ADDITIONAL_SEAT_ID as string,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b2263b9c99249839 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:201 
                privacy_policy_url: `${process.env.APP_URL}/privacy-policy`,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2a23a142f4c8b949 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:202 
                terms_of_service_url: `${process.env.APP_URL}/terms-of-service`

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2feb62a79f1965e0 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:245 
                (item) => (item.price.product as string) === process.env.ADDITIONAL_SEAT_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #708a949509895b83 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:291 
            const basePlanItem = subscription.items.data.find((item) => (item.price.product as string) !== process.env.ADDITIONAL_SEAT_ID)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93d4618d1358e140 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:303 
                product: process.env.ADDITIONAL_SEAT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77ff4c446b88ea3d — Environment-variable access.
repo/packages/server/src/StripeManager.ts:319 
                (item) => (item.price.product as string) === process.env.ADDITIONAL_SEAT_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8cff5328d6f3eec6 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:378 
                (item) => (item.price.product as string) === process.env.ADDITIONAL_SEAT_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #14e89199ca8892d3 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:383 
                product: process.env.ADDITIONAL_SEAT_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37e3cf7be795a1eb — Environment-variable access.
repo/packages/server/src/StripeManager.ts:463 
            const isStarterPlan = newPlanId === process.env.CLOUD_STARTER_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0b11d503b27f167 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:534 
            const isStarterPlan = newPlanId === process.env.CLOUD_STARTER_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5f970659d121a411 — Environment-variable access.
repo/packages/server/src/StripeManager.ts:546 
                        plan_id: process.env.CLOUD_STARTER_ID || ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c3887b20df7f5b02 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:37 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e238d0e21a6473e6 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:39 
            if (process.env.REDIS_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #98be3b7c02331c5c — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:41 
                    url: process.env.REDIS_URL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #061b08a0d9bae3a3 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:44 
                            process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77708dd5921a277b — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:45 
                                ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2019807f765a1951 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:49 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b212fb88b783852e — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:50 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6d9e9d44f54b7464 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:55 
                    username: process.env.REDIS_USERNAME || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d0a397f3b97735d9 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:56 
                    password: process.env.REDIS_PASSWORD || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e2da60c1d7764912 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:58 
                        host: process.env.REDIS_HOST || 'localhost',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23cf1dc711532bb3 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:59 
                        port: parseInt(process.env.REDIS_PORT || '6379'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #970cd39f0916a83c — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:60 
                        tls: process.env.REDIS_TLS === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #84ca67464eb166ba — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:61 
                        cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13982cfb92a90f3d — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:62 
                        key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dae105746229c9b0 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:63 
                        ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4911e0ac8edc8a1 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:65 
                            process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2ec33c9cf0ed8ea6 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:66 
                                ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #634b9a00343103e5 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:70 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #84281ae47e95a6b8 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:71 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #15db05724e27b7c2 — Environment-variable access.
repo/packages/server/src/UsageCacheManager.ts:147 
            (item) => (item.price.product as string) === process.env.ADDITIONAL_SEAT_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54b046ce0f635032 — Environment-variable access.
repo/packages/server/src/commands/base.ts:217 
                process.env[key] = flags[key]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #44a1cca66588bac4 — Environment-variable access.
repo/packages/server/src/controllers/evaluations/index.ts:32 
        const baseURL = `${process.env.APP_URL}`

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1ced565374c2be41 — Environment-variable access.
repo/packages/server/src/controllers/evaluations/index.ts:56 
        const baseURL = `${process.env.APP_URL}`

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a356311ab8717b4 — Filesystem access.
repo/packages/server/src/controllers/get-upload-file/index.ts:2 
import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c99dfc17a36717e5 — Environment-variable access.
repo/packages/server/src/controllers/internal-predictions/index.ts:36 
    const isQueueMode = process.env.MODE === MODE.QUEUE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #1e48dc18d8a83f25 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/server/src/controllers/nvidia-nim/index.ts:17 
        const response = await axios.post('https://nts.ngc.nvidia.com/v1/token', data, { headers })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #ec7cf5ea873f8809 — Filesystem access.
repo/packages/server/src/controllers/openai-assistants/index.ts:2 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #591a21c03cb1977e — Environment-variable access.
repo/packages/server/src/controllers/predictions/index.ts:67 
                const isQueueMode = process.env.MODE === MODE.QUEUE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #39bf114a7719d7a8 — Environment-variable access.
repo/packages/server/src/controllers/pricing/index.ts:6 
            FREE: process.env.CLOUD_FREE_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a94bc8c2e27a8c61 — Environment-variable access.
repo/packages/server/src/controllers/pricing/index.ts:7 
            STARTER: process.env.CLOUD_STARTER_ID,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #03f89ea0c5ca803e — Environment-variable access.
repo/packages/server/src/controllers/pricing/index.ts:8 
            PRO: process.env.CLOUD_PRO_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8f643294797b0002 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:16 
        if (process.env.REDIS_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12941910c61c49b9 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:17 
            redisClient = new Redis(process.env.REDIS_URL)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9d61141a250fcc32 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:20 
                host: process.env.REDIS_HOST || 'localhost',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #77f0af499d9e2fd5 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:21 
                port: parseInt(process.env.REDIS_PORT || '6379'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6fbfad597ce8ecc6 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:22 
                username: process.env.REDIS_USERNAME || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #897d0078009639fb — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:23 
                password: process.env.REDIS_PASSWORD || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f98606ab721491d5 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:25 
                    process.env.REDIS_TLS === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72d9539ea44dad49 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:27 
                              cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #16f951ea895c7254 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:28 
                              key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ea60952d430d6a5 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:29 
                              ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #57f1648a74fb3be3 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:44 
    const databaseType = process.env.DATABASE_TYPE || 'sqlite'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ab39c624b1ac30aa — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:50 
                host: process.env.DATABASE_HOST,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dc2a16912981e36f — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:51 
                port: parseInt(process.env.DATABASE_PORT || '3306'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2baf11508bd22669 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:52 
                user: process.env.DATABASE_USER,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85e4269472ff4016 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:53 
                password: process.env.DATABASE_PASSWORD,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #78bac222f82980da — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:54 
                database: process.env.DATABASE_NAME,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #02721b7aa47d6f3c — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:73 
                host: process.env.DATABASE_HOST,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e77da10cede4375c — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:74 
                port: parseInt(process.env.DATABASE_PORT || '5432'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #181deb5710869e1b — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:75 
                user: process.env.DATABASE_USER,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f61a7453c5309412 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:76 
                password: process.env.DATABASE_PASSWORD,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f971bc55cb03e1f8 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:77 
                database: process.env.DATABASE_NAME,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b0f1f77d6580705d — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:93 
            const homePath = process.env.DATABASE_PATH ?? flowisePath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #848a8111cf5be82e — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/SessionPersistance.ts:153 
            const databaseType = process.env.DATABASE_TYPE || 'sqlite'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4ea076b5c4780aac — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:36 
const expireAuthTokensOnRestart = process.env.EXPIRE_AUTH_TOKENS_ON_RESTART === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8459b8b9f18f643a — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:42 
    process.env.NODE_ENV === 'production'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5b14f89a9731f06f — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:44 
        : process.env.SECURE_COOKIES === 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #da425316e4ca88e8 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:46 
        : process.env.SECURE_COOKIES === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #329fd98fe7cf03ef — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:48 
        : process.env.APP_URL?.startsWith('https')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2c4e0e5104ad8b65 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:68 
        if (process.env.MODE === 'queue') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e6f40568303a24f9 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:371 
        expiryInMinutes = process.env.JWT_TOKEN_EXPIRY_IN_MINUTES ? parseInt(process.env.JWT_TOKEN_EXPIRY_IN_MINUTES) : 60

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0f193a69b4dad758 — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:391 
        expiryInMinutes = process.env.JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8b40f360f4043b6f — Environment-variable access.
repo/packages/server/src/enterprise/middleware/passport/index.ts:392 
            ? parseInt(process.env.JWT_REFRESH_TOKEN_EXPIRY_IN_MINUTES)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #143d91bc983f73f8 — Environment-variable access.
repo/packages/server/src/enterprise/services/account.service.ts:155 
            const expiryInHours = process.env.INVITE_TOKEN_EXPIRY_IN_HOURS ? parseInt(process.env.INVITE_TOKEN_EXPIRY_IN_HOURS) : 24

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9bd3ca0a65d39ef2 — Environment-variable access.
repo/packages/server/src/enterprise/services/account.service.ts:218 
                    const expiryInHours = process.env.INVITE_TOKEN_EXPIRY_IN_HOURS ? parseInt(process.env.INVITE_TOKEN_EXPIRY_IN_HOURS) : 24

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1143d7c1a064e05c — Environment-variable access.
repo/packages/server/src/enterprise/services/account.service.ts:373 
                const expiryInHours = process.env.INVITE_TOKEN_EXPIRY_IN_HOURS ? parseInt(process.env.INVITE_TOKEN_EXPIRY_IN_HOURS) : 24

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #10200c8c8eccf7e0 — Environment-variable access.
repo/packages/server/src/enterprise/services/account.service.ts:446 
                    const expiryInHours = process.env.INVITE_TOKEN_EXPIRY_IN_HOURS ? parseInt(process.env.INVITE_TOKEN_EXPIRY_IN_HOURS) : 24

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #05b370a8c650a1eb — Environment-variable access.
repo/packages/server/src/enterprise/services/account.service.ts:637 
            const expiryInMins = process.env.PASSWORD_RESET_TOKEN_EXPIRY_IN_MINUTES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5c273a0118c41905 — Environment-variable access.
repo/packages/server/src/enterprise/services/account.service.ts:638 
                ? parseInt(process.env.PASSWORD_RESET_TOKEN_EXPIRY_IN_MINUTES)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0977126cf0f5bd9f — Environment-variable access.
repo/packages/server/src/enterprise/services/account.service.ts:878 
            const expiryInHours = process.env.INVITE_TOKEN_EXPIRY_IN_HOURS ? parseInt(process.env.INVITE_TOKEN_EXPIRY_IN_HOURS) : 24

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fdde1a2bbfa437bb — Environment-variable access.
repo/packages/server/src/enterprise/sso/Auth0SSO.ts:49 
        const APP_URL = process.env.APP_URL || 'http://127.0.0.1:' + process.env.PORT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #1aa0ca2686dbf268 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/Auth0SSO.ts:149 
            const tokenResponse = await axios.post(
                `https://${validatedDomain}/oauth/token`,
                {
                    client_id: clientID,
                    client_secret: clientSecret,
                    audience: `https://${validatedDomain}/api/v2/`,
                    grant_type: 'client_credentials'
                },
                {
                    headers: { 'Content-Type': 'application/json' }
                }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d917f9cb8de33e28 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/Auth0SSO.ts:178 
            const response = await axios.post(
                `https://${validatedDomain}/oauth/token`,
                {
                    client_id: clientID,
                    client_secret: clientSecret,
                    grant_type: 'refresh_token',
                    refresh_token: ssoRefreshToken
                },
                {
                    headers: { 'Content-Type': 'application/json' }
                }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #b098d0d12463602a — Environment-variable access.
repo/packages/server/src/enterprise/sso/AzureSSO.ts:21 
        const APP_URL = process.env.APP_URL || 'http://127.0.0.1:' + process.env.PORT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #ac996c9380f96443 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/AzureSSO.ts:120 
            const tokenResponse = await axios.post(
                `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/token`,
                new URLSearchParams({
                    client_id: clientID,
                    client_secret: clientSecret,
                    grant_type: 'client_credentials',
                    scope: 'https://graph.microsoft.com/.default'
                }).toString(),
                {
                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
                }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2e6183a75418aab1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/AzureSSO.ts:143 
            const response = await axios.post(
                `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/token`,
                new URLSearchParams({
                    client_id: clientID || '',
                    client_secret: clientSecret || '',
                    grant_type: 'refresh_token',
                    refresh_token: ssoRefreshToken,
                    scope: 'openid profile email'
                }).toString(),
                {
                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
                }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #75c3686adfe1741b — Environment-variable access.
repo/packages/server/src/enterprise/sso/GithubSSO.ts:17 
        const APP_URL = process.env.APP_URL || 'http://127.0.0.1:' + process.env.PORT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #0820089a9b9e597c — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/GithubSSO.ts:38 
                        const emailResponse = await fetch('https://api.github.com/user/emails', {
                            headers: {
                                Authorization: `token ${accessToken}`,
                                'User-Agent': 'Node.js'
                            }
                        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1b2cbeb3bbf7f7fc — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/GithubSSO.ts:106 
            const response = await fetch('https://github.com/login/oauth/access_token', {
                method: 'POST',
                headers: {
                    Accept: 'application/json',
                    'Content-Type': 'application/json'
                },
                body: JSON.stringify({
                    client_id: clientID,
                    client_secret: clientSecret,
                    code: 'dummy_code_for_testing'
                })
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2757edca9dbe8add — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/GithubSSO.ts:133 
            const response = await fetch('https://github.com/login/oauth/access_token', {
                method: 'POST',
                headers: {
                    Accept: 'application/json',
                    'Content-Type': 'application/json'
                },
                body: JSON.stringify({
                    client_id: clientID,
                    client_secret: clientSecret,
                    grant_type: 'refresh_token',
                    refresh_token: currentRefreshToken
                })
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #fb4cc31ed752e56f — Environment-variable access.
repo/packages/server/src/enterprise/sso/GoogleSSO.ts:20 
        const APP_URL = process.env.APP_URL || 'http://127.0.0.1:' + process.env.PORT

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #89f095cf61f6f39f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/GoogleSSO.ts:129 
            const tokenResponse = await axios.get(authorizationUrl)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #7d8bede38ce223f8 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/server/src/enterprise/sso/GoogleSSO.ts:141 
            const response = await axios.post(
                `https://oauth2.googleapis.com/token`,
                new URLSearchParams({
                    client_id: clientID || '',
                    client_secret: clientSecret || '',
                    grant_type: 'refresh_token',
                    refresh_token: ssoRefreshToken,
                    scope: 'refresh_token'
                }).toString(),
                {
                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
                }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #b48adb1ce378603f — Environment-variable access.
repo/packages/server/src/enterprise/utils/encryption.util.ts:6 
    return parseInt(process.env.PASSWORD_SALT_HASH_ROUNDS || '10', 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2ef58675c03b401b — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:7 
const SMTP_HOST = process.env.SMTP_HOST

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f0e98cc9138057e4 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:8 
const SMTP_PORT = parseInt(process.env.SMTP_PORT as string, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69c8f879111f99d1 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:9 
const SMTP_USER = process.env.SMTP_USER

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2b0137e6c4680567 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:10 
const SMTP_PASSWORD = process.env.SMTP_PASSWORD

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #29ed16dc33893e62 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:13 
    const port = parseInt(process.env.SMTP_PORT as string, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #93f5cb9f4dbea031 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:15 
        process.env.SMTP_HOST?.trim() &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #84c6b751d1334cc0 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:16 
            process.env.SMTP_USER?.trim() &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6b3fba4c4774cbaf — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:17 
            process.env.SMTP_PASSWORD?.trim() &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #44fbc9934d004020 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:18 
            process.env.SMTP_PORT &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4f573c3bc69fca50 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:22 
const SENDER_EMAIL = process.env.SENDER_EMAIL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6231f65dc562282b — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:23 
const SMTP_SECURE = process.env.SMTP_SECURE ? process.env.SMTP_SECURE === 'true' : true

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a5463f5dc88b012d — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:24 
const TLS = process.env.ALLOW_UNAUTHORIZED_CERTS ? { rejectUnauthorized: false } : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3cc371d8449ad46a — Filesystem access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:40 
            return fs.readFileSync(userTemplatePath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dae02e2fc3ff0caa — Filesystem access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:45 
    return fs.readFileSync(path.join(__dirname, '../', 'emails', defaultTemplateName), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53d9552b19e2e4fe — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:52 
    const template = getEmailTemplate('workspace_add_cloud.hbs', process.env.WORKSPACE_INVITE_TEMPLATE_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6268a85098256c41 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:80 
                  process.env.WORKSPACE_INVITE_TEMPLATE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9c76150c0a7b8323 — Environment-variable access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:84 
                  process.env.WORKSPACE_INVITE_TEMPLATE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #52163415d2687c3e — Filesystem access.
repo/packages/server/src/enterprise/utils/sendEmail.ts:100 
    const passwordResetTemplateSource = fs.readFileSync(path.join(__dirname, '../', 'emails', 'workspace_user_reset_password.hbs'), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #937cca3ff808f1db — Environment-variable access.
repo/packages/server/src/enterprise/utils/tempTokenUtils.ts:80 
        const expiryInHours = process.env.INVITE_TOKEN_EXPIRY_IN_HOURS ? parseInt(process.env.INVITE_TOKEN_EXPIRY_IN_HOURS) : 24

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c24672bed1d8d239 — Environment-variable access.
repo/packages/server/src/enterprise/utils/tempTokenUtils.ts:85 
        const expiryInMins = process.env.PASSWORD_RESET_TOKEN_EXPIRY_IN_MINUTES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #13a393fb5f28dc47 — Environment-variable access.
repo/packages/server/src/enterprise/utils/tempTokenUtils.ts:86 
            ? parseInt(process.env.PASSWORD_RESET_TOKEN_EXPIRY_IN_MINUTES)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #57c45030080bb492 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:11 
    const originalEnv = process.env.APP_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4f3132faa134c880 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:15 
            process.env.APP_URL = originalEnv

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5f48e90e5fb35eaf — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:17 
            delete process.env.APP_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #232b0299715b75f9 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:23 
            delete process.env.APP_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d30aa06db42ca475 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:28 
            process.env.APP_URL = 'example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #2eb2ca1c0f1a25f4 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:33 
            process.env.APP_URL = 'https://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #80010d769189b9c0 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:38 
            process.env.APP_URL = 'http://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #36522674f0586690 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:44 
            process.env.APP_URL = 'http://localhost:3000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4683890e317b0545 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:49 
            process.env.APP_URL = 'http://127.0.0.1:3000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #555aa4aec6728e01 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:54 
            process.env.APP_URL = 'http://[::1]:3000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #4e260478bd45dc03 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:59 
            process.env.APP_URL = 'http://0.0.0.0:3000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5fba9e9b63bc7291 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:64 
            process.env.APP_URL = 'https://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #69f35702868bb448 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:69 
            process.env.APP_URL = 'https://example.com/'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9161dbdd4de0835b — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:74 
            process.env.APP_URL = 'https://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #82ae35efc05c3593 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:79 
            process.env.APP_URL = 'http://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bb79d3e910318565 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:86 
            process.env.APP_URL = 'https://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #aebdcf87633dc10d — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:92 
            process.env.APP_URL = 'http://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fd708dfd9f81bcd7 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:98 
            process.env.APP_URL = 'http://localhost:3000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fd12618e5e965e71 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:104 
            process.env.APP_URL = 'https://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #69a9f1a284b2eb82 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:113 
            process.env.APP_URL = 'http://myapp.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a8a7b680fa6a8ad9 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:120 
            process.env.APP_URL = 'http://myapp.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a8164c27782ff633 — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.test.ts:126 
            process.env.APP_URL = 'http://myapp.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9fe85b0283489e2b — Environment-variable access.
repo/packages/server/src/enterprise/utils/url.util.ts:11 
    const appUrl = process.env.APP_URL || ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #289580fe3c496e77 — Environment-variable access.
repo/packages/server/src/index.ts:137 
            if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a0b33c61c0cd4e8 — Environment-variable access.
repo/packages/server/src/index.ts:174 
        const flowise_file_size_limit = process.env.FLOWISE_FILE_SIZE_LIMIT || '50mb'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8095f3f63ccf15cc — Environment-variable access.
repo/packages/server/src/index.ts:184 
        let trustProxy: string | boolean | number | undefined = process.env.TRUST_PROXY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9661e781d85300c1 — Environment-variable access.
repo/packages/server/src/index.ts:223 
        const denylistURLs = process.env.DENYLIST_URLS ? process.env.DENYLIST_URLS.split(',') : []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bff1c1792bf769ae — Environment-variable access.
repo/packages/server/src/index.ts:305 
        if (process.env.ENABLE_METRICS === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #81b1a209c8d72296 — Environment-variable access.
repo/packages/server/src/index.ts:306 
            switch (process.env.METRICS_PROVIDER) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e06614950127d9ff — Environment-variable access.
repo/packages/server/src/index.ts:339 
        if (process.env.MODE === MODE.QUEUE && process.env.ENABLE_BULLMQ_DASHBOARD === 'true' && !this.identityManager.isCloud()) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #424d4d2ce5e63db3 — Environment-variable access.
repo/packages/server/src/index.ts:346 
                process.env.ADMIN_RATE_LIMIT_MESSAGE || 'Too many requests to admin dashboard, please try again later.'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c9ebd11414a593b7 — Environment-variable access.
repo/packages/server/src/index.ts:392 
    const host = process.env.HOST

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8775cfbc3250a15c — Environment-variable access.
repo/packages/server/src/index.ts:393 
    const port = parseInt(process.env.PORT || '', 10) || 3000

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8fe06f69d35bf0ee — Environment-variable access.
repo/packages/server/src/metrics/OpenTelemetry.ts:29 
        if (!process.env.METRICS_OPEN_TELEMETRY_METRIC_ENDPOINT) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #afc2278e9f9508de — Environment-variable access.
repo/packages/server/src/metrics/OpenTelemetry.ts:33 
        if (process.env.METRICS_OPEN_TELEMETRY_DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37c5d222344d8c08 — Environment-variable access.
repo/packages/server/src/metrics/OpenTelemetry.ts:51 
                [ATTR_SERVICE_NAME]: process.env.METRICS_SERVICE_NAME || 'FlowiseAI',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #197b948ab005efc0 — Environment-variable access.
repo/packages/server/src/metrics/OpenTelemetry.ts:55 
            const metricProtocol = process.env.METRICS_OPEN_TELEMETRY_PROTOCOL || 'http' // Default to 'http'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d027eddc72674ca5 — Environment-variable access.
repo/packages/server/src/metrics/OpenTelemetry.ts:79 
                url: process.env.METRICS_OPEN_TELEMETRY_METRIC_ENDPOINT // OTLP endpoint for metrics

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06f448f588314943 — Environment-variable access.
repo/packages/server/src/metrics/Prometheus.ts:26 
        const serviceName: string = process.env.METRICS_SERVICE_NAME || 'FlowiseAI'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #742905f595b8fd5f — Environment-variable access.
repo/packages/server/src/metrics/Prometheus.ts:155 
        if (process.env.METRICS_INCLUDE_NODE_METRICS !== 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ecae1cbbf099ede0 — Environment-variable access.
repo/packages/server/src/middlewares/errors/index.ts:16 
        stack: process.env.NODE_ENV === 'development' ? err.stack : {}

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e0a6fc3204759291 — Environment-variable access.
repo/packages/server/src/queue/BaseQueue.ts:5 
const QUEUE_REDIS_EVENT_STREAM_MAX_LEN = process.env.QUEUE_REDIS_EVENT_STREAM_MAX_LEN

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6e81e3970f94e67c — Environment-variable access.
repo/packages/server/src/queue/BaseQueue.ts:6 
    ? parseInt(process.env.QUEUE_REDIS_EVENT_STREAM_MAX_LEN)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #35952745da795dc2 — Environment-variable access.
repo/packages/server/src/queue/BaseQueue.ts:8 
const WORKER_CONCURRENCY = process.env.WORKER_CONCURRENCY ? parseInt(process.env.WORKER_CONCURRENCY) : 100000

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09395c71c0b72d11 — Environment-variable access.
repo/packages/server/src/queue/BaseQueue.ts:9 
const REMOVE_ON_AGE = process.env.REMOVE_ON_AGE ? parseInt(process.env.REMOVE_ON_AGE) : -1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #059795b7e72d667f — Environment-variable access.
repo/packages/server/src/queue/BaseQueue.ts:10 
const REMOVE_ON_COUNT = process.env.REMOVE_ON_COUNT ? parseInt(process.env.REMOVE_ON_COUNT) : -1

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7df2e739a334a8c9 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:18 
const QUEUE_NAME = process.env.QUEUE_NAME || 'flowise-queue'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9892d604ea579144 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:30 
        if (process.env.REDIS_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5937d7ef98112f1f — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:32 
            if (process.env.REDIS_URL.startsWith('rediss://')) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #94bb39f527e57791 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:36 
            } else if (process.env.REDIS_TLS === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #53625e274e27ab2a — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:38 
                    cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #12510dc22b459276 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:39 
                    key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #72667616c08dc9cc — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:40 
                    ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b0d58f96aa54656c — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:44 
                url: process.env.REDIS_URL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0a5a2fe332c6b6d2 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:48 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #65ec8ce121a5e0ec — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:49 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d50c4ef39424e604 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:54 
            if (process.env.REDIS_TLS === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b7e620bcd7623b44 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:56 
                    cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54ca463dc39081be — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:57 
                    key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #af3f3cf6f2d6f1d2 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:58 
                    ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f7372e046bec5b78 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:62 
                host: process.env.REDIS_HOST || 'localhost',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a0183e0613666ce1 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:63 
                port: parseInt(process.env.REDIS_PORT || '6379'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a297d227faf417f5 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:64 
                username: process.env.REDIS_USERNAME || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #69682427ccf2295e — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:65 
                password: process.env.REDIS_PASSWORD || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2a0c5b9ed801124b — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:69 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #49c78eca65819cc4 — Environment-variable access.
repo/packages/server/src/queue/QueueManager.ts:70 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #18f4e669ee81dfd5 — Environment-variable access.
repo/packages/server/src/routes/mcp-endpoint/index.test.ts:60 
        delete process.env.MCP_CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cc60dfdf603bfcf5 — Environment-variable access.
repo/packages/server/src/routes/mcp-endpoint/index.test.ts:98 
        delete process.env.MCP_CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c0d57c4ef90a7cdf — Environment-variable access.
repo/packages/server/src/routes/mcp-endpoint/index.test.ts:142 
        process.env.MCP_CORS_ORIGINS = '*'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #37db7b1f3ea44b8e — Environment-variable access.
repo/packages/server/src/routes/mcp-endpoint/index.test.ts:147 
        delete process.env.MCP_CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #44b503abe6034ed6 — Environment-variable access.
repo/packages/server/src/routes/mcp-endpoint/index.test.ts:180 
        process.env.MCP_CORS_ORIGINS = 'https://allowed.example.com, https://also-allowed.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9de07acc90a33d74 — Environment-variable access.
repo/packages/server/src/routes/mcp-endpoint/index.test.ts:185 
        delete process.env.MCP_CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #97efda55652e4852 — Environment-variable access.
repo/packages/server/src/routes/mcp-endpoint/index.ts:13 
const mcpCorsOrigins = process.env.MCP_CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #bdab65dc10f51f3b — Environment-variable access.
repo/packages/server/src/schedule/ScheduleBeat.test.ts:90 
    delete process.env.MODE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5e9e267438737bd7 — Environment-variable access.
repo/packages/server/src/schedule/ScheduleBeat.test.ts:91 
    if (mode) process.env.MODE = mode

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #01a95de3e171cf66 — Environment-variable access.
repo/packages/server/src/schedule/ScheduleBeat.test.ts:115 
    delete process.env.MODE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c5eedfe8fa9037db — Environment-variable access.
repo/packages/server/src/schedule/ScheduleBeat.ts:33 
        this.isQueueMode = process.env.MODE === MODE.QUEUE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #54fe5c56e9c5f9b0 — Environment-variable access.
repo/packages/server/src/schedule/ScheduleExecutor.ts:206 
            baseURL: process.env.APP_URL ?? '',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #56caa152a5d544df — Filesystem access.
repo/packages/server/src/services/agentflowv2-generator/index.ts:6 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c516e0fd59d9af62 — Environment-variable access.
repo/packages/server/src/services/agentflowv2-generator/index.ts:85 
    const disabled_nodes = process.env.DISABLED_NODES ? process.env.DISABLED_NODES.split(',') : []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #525462531c1498a6 — Filesystem access.
repo/packages/server/src/services/agentflowv2-generator/index.ts:109 
            const fileData = fs.readFileSync(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #111aab00bbcce809 — Environment-variable access.
repo/packages/server/src/services/agentflowv2-generator/index.ts:202 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d7ad7754234c52a2 — Environment-variable access.
repo/packages/server/src/services/chat-messages/index.ts:195 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d871f2686d3e60f5 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:691 
        const ORIGINAL_ENV = process.env.CUSTOM_MCP_TOOLS_MAX_BYTES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0b4b2f5b9bc38310 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:693 
            if (ORIGINAL_ENV === undefined) delete process.env.CUSTOM_MCP_TOOLS_MAX_BYTES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9893849f3cd0ad90 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:694 
            else process.env.CUSTOM_MCP_TOOLS_MAX_BYTES = ORIGINAL_ENV

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #276565bc44ef9a87 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:698 
            process.env.CUSTOM_MCP_TOOLS_MAX_BYTES = '50'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e754a4e1031817d4 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:720 
            process.env.CUSTOM_MCP_TOOLS_MAX_BYTES = '0'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a785cb4ae44bc4de — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:749 
        const ORIGINAL_ENV = process.env.CUSTOM_MCP_AUTHORIZE_TIMEOUT_MS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1d09edbc5a5f17a4 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:751 
            if (ORIGINAL_ENV === undefined) delete process.env.CUSTOM_MCP_AUTHORIZE_TIMEOUT_MS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #516f5dee976714e6 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:752 
            else process.env.CUSTOM_MCP_AUTHORIZE_TIMEOUT_MS = ORIGINAL_ENV

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ccac2b63b4ee386c — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.test.ts:758 
            process.env.CUSTOM_MCP_AUTHORIZE_TIMEOUT_MS = '1000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b8bf554b0045b363 — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.ts:19 
    const raw = process.env.CUSTOM_MCP_TOOLS_MAX_BYTES

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9080290637961bee — Environment-variable access.
repo/packages/server/src/services/custom-mcp-servers/index.ts:27 
    const raw = process.env.CUSTOM_MCP_AUTHORIZE_TIMEOUT_MS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fabdc41da571b0ed — Environment-variable access.
repo/packages/server/src/services/documentstore/index.ts:699 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e08f30bd68bf6137 — Environment-variable access.
repo/packages/server/src/services/documentstore/index.ts:907 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eb6750777e910b4f — Environment-variable access.
repo/packages/server/src/services/documentstore/index.ts:1326 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #30079229182130a1 — Environment-variable access.
repo/packages/server/src/services/documentstore/index.ts:2057 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #06a7296c71597878 — Environment-variable access.
repo/packages/server/src/services/documentstore/index.ts:2132 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #247667f5ea821ab8 — Environment-variable access.
repo/packages/server/src/services/export-import/index.ts:891 
                            const baseURL = process.env.BASE_URL || `http://localhost:${process.env.PORT || 3000}`

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #47adac658dc067e1 — Environment-variable access.
repo/packages/server/src/services/fetch-links/index.ts:18 
        if (process.env.DEBUG === 'true') console.info(`Start ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #320e35461cc52d7d — Environment-variable access.
repo/packages/server/src/services/fetch-links/index.ts:20 
        if (process.env.DEBUG === 'true') console.info(`Finish ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6ee21c9e5dd83bb4 — Filesystem access.
repo/packages/server/src/services/log/index.ts:2 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #17bd6dc0adb6b71f — Environment-variable access.
repo/packages/server/src/services/log/index.ts:73 
            const filePath = process.env.LOG_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6c20e0d3bc50c3d1 — Environment-variable access.
repo/packages/server/src/services/log/index.ts:74 
                ? path.resolve(process.env.LOG_PATH, `server.log.${date}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bb6bc5032582c8ee — Filesystem access.
repo/packages/server/src/services/marketplaces/index.ts:1 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b5449b05973889f6 — Filesystem access.
repo/packages/server/src/services/marketplaces/index.ts:37 
            const fileData = fs.readFileSync(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #eada232829a21303 — Filesystem access.
repo/packages/server/src/services/marketplaces/index.ts:58 
            const fileData = fs.readFileSync(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a357a7608007fde7 — Filesystem access.
repo/packages/server/src/services/marketplaces/index.ts:99 
            const fileData = fs.readFileSync(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7f5bcafd42169953 — Environment-variable access.
repo/packages/server/src/services/nodes/index.ts:149 
    if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #7c73e1917e0fc74a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/server/src/services/prompts-lists/index.ts:8 
        const resp = await axios.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #015afffc64b1b1c6 — Environment-variable access.
repo/packages/server/src/services/schedule/utils.ts:10 
const MIN_SCHEDULE_INTERVAL_SECONDS = Math.max(1, parseInt(process.env.MIN_SCHEDULE_INTERVAL_SECONDS || '60', 10) || 60)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #909b62fd1adc415d — Filesystem access.
repo/packages/server/src/services/versions/index.ts:2 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #678abff63d6817c6 — Filesystem access.
repo/packages/server/src/services/versions/index.ts:29 
            const content = await fs.promises.readFile(packagejsonPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1e5a1567def475c2 — Environment-variable access.
repo/packages/server/src/services/webhook-listener/registry.ts:217 
    if (process.env.MODE === MODE.QUEUE && redisEventSubscriber) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0cd48cf06bb1fb2b — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:22 
    const SAVED_CORS_ORIGINS = process.env.CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #05f17128f897593d — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:23 
    const SAVED_CORS_ALLOW_CREDENTIALS = process.env.CORS_ALLOW_CREDENTIALS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3a0c926bf7b39bb7 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:26 
        if (SAVED_CORS_ORIGINS !== undefined) process.env.CORS_ORIGINS = SAVED_CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0e961793a8f637b2 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:27 
        else delete process.env.CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #540616eea0a3f4f7 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:28 
        if (SAVED_CORS_ALLOW_CREDENTIALS !== undefined) process.env.CORS_ALLOW_CREDENTIALS = SAVED_CORS_ALLOW_CREDENTIALS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0c0f1b546dd95624 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:29 
        else delete process.env.CORS_ALLOW_CREDENTIALS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #03ce506f3564470c — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:33 
        if (corsOrigins === undefined) delete process.env.CORS_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #b1f1c9a5c16b09f4 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:34 
        else process.env.CORS_ORIGINS = corsOrigins

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #86022268a86d3a2d — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:35 
        if (corsAllowCredentials === undefined) delete process.env.CORS_ALLOW_CREDENTIALS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #766b0d43dc834808 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:36 
        else process.env.CORS_ALLOW_CREDENTIALS = corsAllowCredentials

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #1b9bc169001a3d91 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:71 
            process.env.CORS_ORIGINS = '*'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a6f19c419e95cdf0 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:72 
            process.env.CORS_ALLOW_CREDENTIALS = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3cb58863c2488f8c — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:78 
            process.env.CORS_ORIGINS = '*'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #178f6395ac7acf93 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:79 
            delete process.env.CORS_ALLOW_CREDENTIALS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5e2722f383e366b1 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:85 
            process.env.CORS_ORIGINS = 'https://trusted.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #3ece89a11225264c — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:86 
            process.env.CORS_ALLOW_CREDENTIALS = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #eb199dc1c4416edc — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:94 
    const originalEnv = process.env.IFRAME_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #67c98d78b1d3f445 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:99 
            process.env.IFRAME_ORIGINS = originalEnv

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c65ef57a1be7ad96 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:101 
            delete process.env.IFRAME_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8ee247a0a8fb5f59 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:107 
            delete process.env.IFRAME_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #771f8292368d387a — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:112 
            process.env.IFRAME_ORIGINS = ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5b1d94ff11a4b168 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:117 
            process.env.IFRAME_ORIGINS = '   '

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #fbf4edded977df2c — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:124 
            process.env.IFRAME_ORIGINS = "'self'"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5f7ae72be79e03d7 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:129 
            process.env.IFRAME_ORIGINS = "'none'"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #095692431c117645 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:134 
            process.env.IFRAME_ORIGINS = '*'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ddcf7fa22bcbcb7b — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:141 
            process.env.IFRAME_ORIGINS = 'https://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #98c2208c6124c83f — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:146 
            process.env.IFRAME_ORIGINS = '  https://example.com  '

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d71d85aeaf6a258c — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:153 
            process.env.IFRAME_ORIGINS = 'https://domain1.com,https://domain2.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #afdccc2fa47789f3 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:158 
            process.env.IFRAME_ORIGINS = 'https://domain1.com, https://domain2.com, https://domain3.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6a154a60408fb4fd — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:163 
            process.env.IFRAME_ORIGINS = '  https://app.com  ,  https://admin.com  '

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9af73afe813ba3da — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:170 
            process.env.IFRAME_ORIGINS = 'https://localhost:3000,https://localhost:4000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #62b4d1ba5b5c41a1 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:175 
            process.env.IFRAME_ORIGINS = 'https://example.com/path1,https://example.com/path2'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #05b2ef24d9d45dda — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:180 
            process.env.IFRAME_ORIGINS = 'http://example.com,https://secure.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #403e7a5828ea380a — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:185 
            process.env.IFRAME_ORIGINS = 'https://example.com,'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #105d8f89a5924314 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:190 
            process.env.IFRAME_ORIGINS = ',https://example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #18b25c0ab7185657 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:195 
            process.env.IFRAME_ORIGINS = 'https://domain1.com,,https://domain2.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #adfc51f23c3bb27f — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:202 
            process.env.IFRAME_ORIGINS = 'https://app.example.com,https://admin.example.com,https://dashboard.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ab8f16aa4f1e0e2c — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:207 
            process.env.IFRAME_ORIGINS = 'http://localhost:3000,http://localhost:3001,http://127.0.0.1:3000'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #072278f446eddf44 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:212 
            process.env.IFRAME_ORIGINS = "'self',https://trusted.com"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0c7785786a7f66f0 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:219 
    const originalEnv = process.env.IFRAME_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #41705abbdce82363 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:223 
            process.env.IFRAME_ORIGINS = originalEnv

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f135994b75152d4b — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:225 
            delete process.env.IFRAME_ORIGINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e0d7cff1810e6dae — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:230 
        process.env.IFRAME_ORIGINS = '*'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #937cb7b453b02f9c — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:237 
        process.env.IFRAME_ORIGINS = "'self'"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #e278380b3812c506 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:245 
        process.env.IFRAME_ORIGINS = "'none'"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7be3fdfa27a9def9 — Environment-variable access.
repo/packages/server/src/utils/XSS.test.ts:253 
        process.env.IFRAME_ORIGINS = 'https://embed.example.com,https://admin.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #dadef16435fb1df2 — Environment-variable access.
repo/packages/server/src/utils/XSS.ts:26 
    return process.env.CORS_ORIGINS ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f79332f120a2aeba — Environment-variable access.
repo/packages/server/src/utils/XSS.ts:30 
    return process.env.CORS_ALLOW_CREDENTIALS === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c6400a25042a0f6c — Environment-variable access.
repo/packages/server/src/utils/XSS.ts:34 
    const appUrl = process.env.APP_URL?.trim()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #325664dd8c441a98 — Environment-variable access.
repo/packages/server/src/utils/XSS.ts:161 
    const origins = (process.env.IFRAME_ORIGINS?.trim() || undefined) ?? "'self'"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1390191c0151e509 — Environment-variable access.
repo/packages/server/src/utils/buildAgentflow.ts:174 
const MAX_LOOP_COUNT = process.env.MAX_LOOP_COUNT ? parseInt(process.env.MAX_LOOP_COUNT) : 10

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d69f89da61b3bdb8 — Environment-variable access.
repo/packages/server/src/utils/buildAgentflow.ts:1912 
    const maxIterations = process.env.MAX_ITERATIONS ? parseInt(process.env.MAX_ITERATIONS) : 1000

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5df4e3396d02889e — Environment-variable access.
repo/packages/server/src/utils/buildChatflow.ts:1084 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #07506d8d2d8030d1 — Environment-variable access.
repo/packages/server/src/utils/config.ts:10 
    dir: process.env.LOG_PATH ?? path.join(__dirname, '..', '..', 'logs'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d230713e1792a1b3 — Environment-variable access.
repo/packages/server/src/utils/config.ts:12 
        level: process.env.LOG_LEVEL ?? 'info',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c5bb2417337c003b — Environment-variable access.
repo/packages/server/src/utils/config.ts:17 
        level: process.env.LOG_LEVEL ?? 'info',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f3e699d9fa7fba84 — Filesystem access.
repo/packages/server/src/utils/index.ts:6 
import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0ffa5410943f0b4b — Environment-variable access.
repo/packages/server/src/utils/index.ts:76 
const USE_AWS_SECRETS_MANAGER = process.env.SECRETKEY_STORAGE_TYPE === 'aws'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c063498acd08c30a — Environment-variable access.
repo/packages/server/src/utils/index.ts:78 
    const region = process.env.SECRETKEY_AWS_REGION || 'us-east-1' // Default region if not provided

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #20fe23752ce376c6 — Environment-variable access.
repo/packages/server/src/utils/index.ts:79 
    const accessKeyId = process.env.SECRETKEY_AWS_ACCESS_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0bfc832ecd49d46f — Environment-variable access.
repo/packages/server/src/utils/index.ts:80 
    const secretAccessKey = process.env.SECRETKEY_AWS_SECRET_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #47aaac21e550e088 — Environment-variable access.
repo/packages/server/src/utils/index.ts:120 
    if (process.env[variableName] === undefined) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a664ceaa87e1004d — Environment-variable access.
repo/packages/server/src/utils/index.ts:125 
    return process.env[variableName] as string

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f5d4dfad960560dd — Environment-variable access.
repo/packages/server/src/utils/index.ts:852 
                value = process.env[item.name] ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #766ad58fd726deef — Environment-variable access.
repo/packages/server/src/utils/index.ts:1554 
    if (process.env.FLOWISE_SECRETKEY_OVERWRITE !== undefined && process.env.FLOWISE_SECRETKEY_OVERWRITE !== '') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #28e7af6ddfe3065f — Environment-variable access.
repo/packages/server/src/utils/index.ts:1555 
        return process.env.FLOWISE_SECRETKEY_OVERWRITE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f9e3623dba045c58 — Environment-variable access.
repo/packages/server/src/utils/index.ts:1558 
        const secretId = process.env.SECRETKEY_AWS_NAME || 'FlowiseEncryptionKey'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #aac6c2deaf79ce03 — Filesystem access.
repo/packages/server/src/utils/index.ts:1581 
        return await fs.promises.readFile(getEncryptionKeyPath(), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #861f4b95537b6594 — Environment-variable access.
repo/packages/server/src/utils/index.ts:1584 
        const defaultLocation = process.env.SECRETKEY_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c8e6f0cfbcdfda08 — Environment-variable access.
repo/packages/server/src/utils/index.ts:1585 
            ? path.join(process.env.SECRETKEY_PATH, 'encryption.key')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #775e19b3f2e424f8 — Filesystem access.
repo/packages/server/src/utils/index.ts:1587 
        await fs.promises.writeFile(defaultLocation, encryptKey)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ae3db5bd0c165225 — Environment-variable access.
repo/packages/server/src/utils/index.ts:1670 
    return process.env.SECRETKEY_PATH ? process.env.SECRETKEY_PATH : path.join(getUserHome(), '.flowise')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #bd775f43ccfc55e9 — Environment-variable access.
repo/packages/server/src/utils/index.ts:1697 
    const envVal = process.env[envKey]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b4f1de62ca23cd08 — Environment-variable access.
repo/packages/server/src/utils/index.ts:1704 
        const prefix = process.env.SECRETKEY_AWS_AUTH_PREFIX || 'Flowise'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #46c0463c408b06e6 — Filesystem access.
repo/packages/server/src/utils/index.ts:1729 
        return await fs.promises.readFile(filePath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a706c89e8f3e127e — Filesystem access.
repo/packages/server/src/utils/index.ts:1735 
        await fs.promises.writeFile(filePath, value)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fe89484948a31751 — Filesystem access.
repo/packages/server/src/utils/index.ts:1981 
        const content = await fs.promises.readFile(packagejsonPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1cf08b4783550e39 — Environment-variable access.
repo/packages/server/src/utils/index.ts:2019 
    return process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #faeecf11bdefa563 — Environment-variable access.
repo/packages/server/src/utils/index.ts:2020 
        ? path.join(process.env.BLOB_STORAGE_PATH, 'uploads')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ad7996d075d80bd8 — Environment-variable access.
repo/packages/server/src/utils/logger.test.ts:127 
            process.env.DEBUG = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9c942028c1e371ce — Environment-variable access.
repo/packages/server/src/utils/logger.test.ts:128 
            process.env.LOG_SANITIZE_BODY_FIELDS = 'password,secret'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #9bcd325bd46c9d6b — Environment-variable access.
repo/packages/server/src/utils/logger.test.ts:129 
            process.env.LOG_SANITIZE_HEADER_FIELDS = 'authorization'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f853b5010bce46ce — Environment-variable access.
repo/packages/server/src/utils/logger.test.ts:146 
            process.env.DEBUG = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a99d482822d0ce56 — Environment-variable access.
repo/packages/server/src/utils/logger.test.ts:147 
            delete process.env.LOG_SANITIZE_BODY_FIELDS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #6950325dae918dff — Environment-variable access.
repo/packages/server/src/utils/logger.test.ts:148 
            delete process.env.LOG_SANITIZE_HEADER_FIELDS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7a49197966028c9f — Filesystem access.
repo/packages/server/src/utils/logger.ts:3 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8be15802216ce057 — Environment-variable access.
repo/packages/server/src/utils/logger.ts:40 
    exceptionHandlers: [...(process.env.DEBUG && process.env.DEBUG === 'true' ? [new transports.Console()] : []), ...errorTransports],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d4ae100229ff059b — Environment-variable access.
repo/packages/server/src/utils/logger.ts:42 
        ...(process.env.DEBUG && process.env.DEBUG === 'true' ? [new transports.Console()] : []),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b4f55f6515198524 — Environment-variable access.
repo/packages/server/src/utils/logger.ts:45 
        ...((!process.env.DEBUG || process.env.DEBUG !== 'true') && errorTransports.length === 0 ? [new transports.Console()] : [])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79dcfbbebb4c588a — Environment-variable access.
repo/packages/server/src/utils/logger.ts:54 
    transports: [...(process.env.DEBUG && process.env.DEBUG === 'true' ? [new transports.Console()] : []), ...requestTransports]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74fe9a43ae96e628 — Environment-variable access.
repo/packages/server/src/utils/logger.ts:58 
    if (!process.env.LOG_SANITIZE_BODY_FIELDS) return []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2043381d5710f0ee — Environment-variable access.
repo/packages/server/src/utils/logger.ts:59 
    return (process.env.LOG_SANITIZE_BODY_FIELDS as string)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d2cfb85e6dbb0a84 — Environment-variable access.
repo/packages/server/src/utils/logger.ts:66 
    if (!process.env.LOG_SANITIZE_HEADER_FIELDS) return []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3db2a8f8f5a916c1 — Environment-variable access.
repo/packages/server/src/utils/logger.ts:67 
    return (process.env.LOG_SANITIZE_HEADER_FIELDS as string)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #85693a9027101873 — Environment-variable access.
repo/packages/server/src/utils/logger.ts:96 
        const isDebugLevel = logger.level === 'debug' || process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #44d813c69ce6c7ae — Environment-variable access.
repo/packages/server/src/utils/logger.ts:151 
    transports: [...(process.env.DEBUG === 'true' ? [new transports.Console()] : []), ...auditTransports]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #dc7d61e084a6d621 — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:44 
    delete process.env.OAUTH2_SECURITY_CHECK

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c38031311d1a8d64 — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:45 
    delete process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f92bb3225da798de — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:63 
        process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = 'custom.example.com, another.dev'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #ec9f1d0e99f6939f — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:73 
        process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = 'github.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #a047ba446635be5d — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:80 
        process.env.OAUTH2_SECURITY_CHECK = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f207cefeba77fa1b — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:81 
        process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = 'my.corp.dev'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #31a40add94317936 — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:87 
        process.env.OAUTH2_SECURITY_CHECK = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #79617a0a17509b0e — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:93 
        process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = '  MyDomain.COM , UPPER.IO  '

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #652b18e5cf293deb — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:100 
        process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = ',,,valid.com,,,'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7ead35aa6d1ea645 — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:137 
            process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = 'custom-idp.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #c10093ef54d9c0eb — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:148 
            process.env.OAUTH2_SECURITY_CHECK = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #5a99af1b78c0558a — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:156 
            process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = 'local.dev'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #8fb93d60866daaff — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:161 
            process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = 'local.dev'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #69d9b3d5a0657595 — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.test.ts:166 
            process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS = 'myidp.local'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9ec99f8fa8c275f — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.ts:4 
    return (process.env.OAUTH2_ALLOWED_TOKEN_DOMAINS ?? '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #05b8b96631cf3631 — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.ts:21 
    const securityCheckEnabled = process.env.OAUTH2_SECURITY_CHECK !== 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e691467dd14e492 — Environment-variable access.
repo/packages/server/src/utils/oauth2Security.ts:49 
    const securityCheckEnabled = process.env.OAUTH2_SECURITY_CHECK !== 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d77c87cc439bc59c — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:25 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #82c249fa3ecf34c5 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:26 
            if (process.env.REDIS_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f7f4c86c0fdb0cf4 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:27 
                this.redisClient = new Redis(process.env.REDIS_URL, {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5840c3e07d9d0250 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:29 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #83fff483fa04fe34 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:30 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0c514c4d25895ab1 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:35 
                    host: process.env.REDIS_HOST || 'localhost',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cb590c242c189d53 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:36 
                    port: parseInt(process.env.REDIS_PORT || '6379'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0602161a2232552b — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:37 
                    username: process.env.REDIS_USERNAME || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9ae6f5d2a53726f6 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:38 
                    password: process.env.REDIS_PASSWORD || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f074a62e59bce12f — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:40 
                        process.env.REDIS_TLS === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #feb3864e4ef3bf0f — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:42 
                                  cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d87fc2cb7b9fdcfc — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:43 
                                  key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1fcb04ef69bd67c — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:44 
                                  ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #354ecba0982b5dd5 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:48 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #a4fc928fbea08e6f — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:49 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ad16dc080e455edc — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:60 
        if (process.env.REDIS_URL && process.env.REDIS_URL.startsWith('rediss://')) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #23033f31a0f219df — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:64 
        } else if (process.env.REDIS_TLS === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3e5f0d861c9e02c5 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:66 
                cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e9632b18e4f97e52 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:67 
                key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e63933ce628bf983 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:68 
                ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1a065ec31dcee74f — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:72 
            url: process.env.REDIS_URL || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #135583bf339bcb35 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:73 
            host: process.env.REDIS_HOST || 'localhost',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cc7fc33b567e6776 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:74 
            port: parseInt(process.env.REDIS_PORT || '6379'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7d10d65aaa08c8e3 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:75 
            username: process.env.REDIS_USERNAME || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5fbc41cb40297043 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:76 
            password: process.env.REDIS_PASSWORD || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b2b300eb0cdf12b7 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:81 
                process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5ee7e1156a9c3eb0 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:82 
                    ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c7da365e31bfa228 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:97 
            if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #09134aacbd47c215 — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:160 
        if (!isInitialized && process.env.MODE === MODE.QUEUE && this.queueEventsProducer) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fc06513e54b4585b — Environment-variable access.
repo/packages/server/src/utils/rateLimit.ts:184 
        if (process.env.MODE === MODE.QUEUE && this.queueEvents) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #21b1ec99e72496a0 — Environment-variable access.
repo/packages/server/src/utils/redis.ts:4 
    const keepAliveRaw = process.env.REDIS_KEEP_ALIVE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #75ad57a108aea34b — Environment-variable access.
repo/packages/server/src/utils/redis.ts:7 
    if (process.env.REDIS_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5ec33fac614b8bbb — Environment-variable access.
repo/packages/server/src/utils/redis.ts:9 
            url: process.env.REDIS_URL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0084a9bcdc57c4c2 — Environment-variable access.
repo/packages/server/src/utils/redis.ts:16 
        username: process.env.REDIS_USERNAME || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b9722c02f7de324c — Environment-variable access.
repo/packages/server/src/utils/redis.ts:17 
        password: process.env.REDIS_PASSWORD || undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ce3c3d2f005ad66c — Environment-variable access.
repo/packages/server/src/utils/redis.ts:19 
            host: process.env.REDIS_HOST || 'localhost',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #74018b157168cd19 — Environment-variable access.
repo/packages/server/src/utils/redis.ts:20 
            port: parseInt(process.env.REDIS_PORT || '6379'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #24dab98833cf1656 — Environment-variable access.
repo/packages/server/src/utils/redis.ts:21 
            tls: process.env.REDIS_TLS === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1cf06ab41cbdd45 — Environment-variable access.
repo/packages/server/src/utils/redis.ts:22 
            cert: process.env.REDIS_CERT ? Buffer.from(process.env.REDIS_CERT, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #b66c030a22a9f75a — Environment-variable access.
repo/packages/server/src/utils/redis.ts:23 
            key: process.env.REDIS_KEY ? Buffer.from(process.env.REDIS_KEY, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b79a4e1b68a9ada — Environment-variable access.
repo/packages/server/src/utils/redis.ts:24 
            ca: process.env.REDIS_CA ? Buffer.from(process.env.REDIS_CA, 'base64') : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #0020dba15305b454 — Environment-variable access.
repo/packages/server/src/utils/telemetry.test.ts:67 
            delete process.env.POSTHOG_PUBLIC_API_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #7d57716124b2be70 — Environment-variable access.
repo/packages/server/src/utils/telemetry.test.ts:74 
            process.env.POSTHOG_PUBLIC_API_KEY = 'ph-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #19e19144ba78636a — Environment-variable access.
repo/packages/server/src/utils/telemetry.test.ts:97 
            process.env.POSTHOG_PUBLIC_API_KEY = 'ph-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d9a5fabfd447eb20 — Environment-variable access.
repo/packages/server/src/utils/telemetry.ts:18 
        if (process.env.POSTHOG_PUBLIC_API_KEY) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #6e8be806b225e94c — Environment-variable access.
repo/packages/server/src/utils/telemetry.ts:19 
            this.postHog = new PostHog(process.env.POSTHOG_PUBLIC_API_KEY)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3b7d14d5b7e3fcc9 — Environment-variable access.
repo/packages/server/src/utils/upsertVector.ts:307 
        if (process.env.MODE === MODE.QUEUE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (npm)

npm first-party
expand_more 2 low-confidence finding(s)
low env_fs production #448cca04778d238c — Environment-variable access.
repo/.eslintrc.js:25 
        'no-console': [process.env.CI ? 'error' : 'warn', { allow: ['warn', 'error', 'info'] }],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5e53ab24dc34b2dd — Environment-variable access.
repo/docker/worker/healthcheck/healthcheck.js:4 
const port = process.env.WORKER_PORT || 5566

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (npm): packages/agentflow

npm first-party
expand_more 19 low-confidence finding(s)
low egress test-only Excluded from app score #7a832e74c5f3361b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/examples/src/SaveToDbDialog.tsx:37 
            const res = await fetch(`${apiBaseUrl}/api/v1/chatflows`, {
                method: 'POST',
                headers: authHeaders,
                credentials: token ? 'omit' : 'include',
                body: JSON.stringify(body)
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low pii_flow test-only Excluded from app score #c28e49e4ae8e9013 — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent. Non-production path — not application runtime.
repo/packages/agentflow/examples/src/SaveToDbDialog.tsx:37 · flow /tmp/closeopen-1_0nwmaz/repo/packages/agentflow/examples/src/SaveToDbDialog.tsx:26 → /tmp/closeopen-1_0nwmaz/repo/packages/agentflow/examples/src/SaveToDbDialog.tsx:37 
            const res = await fetch(`${apiBaseUrl}/api/v1/chatflows`, {
                method: 'POST',
                headers: authHeaders,
                credentials: token ? 'omit' : 'include',
                body: JSON.stringify(body)
            })

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low egress test-only Excluded from app score #e0966b434d4d6f90 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/examples/src/TestRunDialog.tsx:44 
            const res = await fetch(`${apiBaseUrl}/api/v1/internal-prediction/${agentflowId}`, {
                method: 'POST',
                headers: authHeaders,
                credentials: token ? 'omit' : 'include',
                body: JSON.stringify({ question: question.trim(), streaming: true, chatId })
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low pii_flow test-only Excluded from app score #ea4c35185a35ac3a — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent. Non-production path — not application runtime.
repo/packages/agentflow/examples/src/TestRunDialog.tsx:44 · flow /tmp/closeopen-1_0nwmaz/repo/packages/agentflow/examples/src/TestRunDialog.tsx:32 → /tmp/closeopen-1_0nwmaz/repo/packages/agentflow/examples/src/TestRunDialog.tsx:44 
            const res = await fetch(`${apiBaseUrl}/api/v1/internal-prediction/${agentflowId}`, {
                method: 'POST',
                headers: authHeaders,
                credentials: token ? 'omit' : 'include',
                body: JSON.stringify({ question: question.trim(), streaming: true, chatId })
            })

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
low egress test-only Excluded from app score #b410833fc40e462e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/examples/src/demos/E2eExample.tsx:62 
            const res = await fetch(`${apiBaseUrl}/api/v1/chatflows/${agentflowId}`, {
                method: 'DELETE',
                headers: makeHeaders(),
                credentials
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #1d2b08cf32706eab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/examples/src/demos/E2eExample.tsx:237 
        fetch(`${apiBaseUrl}/api/v1/chatflows/${configuredAgentflowId}`, {
            headers: makeHeaders(),
            credentials
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress test-only Excluded from app score #88e2b39ab4b47f13 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/examples/src/demos/E2eExample.tsx:269 
                const res = await fetch(`${apiBaseUrl}/api/v1/chatflows/${activeChatflowId}`, {
                    method: 'PUT',
                    headers: makeHeaders(true),
                    credentials,
                    body: JSON.stringify({
                        name: flowName,
                        flowData: JSON.stringify({ nodes: flow.nodes, edges: flow.edges, viewport: flow.viewport })
                    })
                })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #477ab76e1c979837 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/chatflows.ts:22 
            const response = await client.get(`/chatflows/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a5f3601cdb7dec1d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/chatflows.ts:58 
            const response = await client.put(`/chatflows/${id}`, updateData)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #35be4a96d2fd03e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/credentials.ts:30 
            const response = await client.get(`/components-credentials/${name}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9035505c55de542c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/credentials.ts:47 
            const response = await client.get(`/credentials/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f7e4510444cdf73c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/credentials.ts:55 
            const response = await client.put(`/credentials/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ce213c00967bcbd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/deduplicatedClient.ts:81 
        const promise = client
            .get<T, R, D>(url, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6400e6410cd6742d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/deduplicatedClient.ts:99 
            return client.post<T, R, D>(url, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cbfa47b08e736f90 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/deduplicatedClient.ts:110 
        const promise = client
            .post<T, R, D>(url, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0984af2260999ab1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/nodes.ts:25 
            const response = await client.get(`/nodes/${name}`, { params: { client: 'agentflowsdk' } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cf238ef88685a74b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/nodes.ts:34 
            const response = await client.post(`/node-load-method/${nodeName}`, { loadMethod, ...body })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e56f7cb642641f7b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/tools.ts:14 
            const response = await client.post(`/node-load-method/${encodeURIComponent(nodeName)}`, { loadMethod: 'listTools' })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b4e129b9c430192c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/agentflow/src/infrastructure/api/tools.ts:23 
            const response = await client.post(`/node-load-method/${encodeURIComponent(nodeName)}`, {
                loadMethod: 'listToolInputArgs',
                currentNode: { inputs }
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

first-party (npm): packages/ui

npm first-party
expand_more 295 low-confidence finding(s)
low egress production #db6245674c450bff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/apikey.js:7 
const updateAPI = (id, body) => client.put(`/apikey/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c8b3e12ae5838f1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:4 
const getAssistantObj = (id, credentialId) => client.get(`/openai-assistants/${id}?credential=${credentialId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d31191db9d222b01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:6 
const getAllAvailableAssistants = (credentialId) => client.get(`/openai-assistants?credential=${credentialId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f1f3f39b62f32427 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:11 
const getAllAssistants = (type) => client.get('/assistants?type=' + type)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b789b63bd20555a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:13 
const getSpecificAssistant = (id) => client.get(`/assistants/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2edf81518f75cc09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:15 
const updateAssistant = (id, body) => client.put(`/assistants/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #336a78aa6b611faa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:21 
const getAssistantVectorStore = (id, credentialId) => client.get(`/openai-assistants-vector-store/${id}?credential=${credentialId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b11dd8a0237261d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:23 
const listAssistantVectorStore = (credentialId) => client.get(`/openai-assistants-vector-store?credential=${credentialId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c9a01d9cdd212495 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:25 
const createAssistantVectorStore = (credentialId, body) => client.post(`/openai-assistants-vector-store?credential=${credentialId}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0f11e2386b3360c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:28 
    client.put(`/openai-assistants-vector-store/${id}?credential=${credentialId}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ab4504c294c5e880 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:34 
    client.post(`/openai-assistants-vector-store/${id}?credential=${credentialId}`, formData, {
        headers: { 'Content-Type': 'multipart/form-data' }
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b6b028f390b0f442 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:39 
    client.patch(`/openai-assistants-vector-store/${id}?credential=${credentialId}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #18ea11cd0b818812 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/assistants.js:43 
    client.post(`/openai-assistants-file/upload?credential=${credentialId}`, formData, {
        headers: { 'Content-Type': 'multipart/form-data' }
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3b5787bd2482e422 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/attachments.js:4 
    client.post(`/attachments/${chatflowid}/${chatid}`, formData, {
        headers: { 'Content-Type': 'multipart/form-data' }
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1f3186d4b0996b5c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/auth.js:8 
const getAllPermissions = (type) => client.get(`/auth/permissions/${type}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4c1fc48b4ce06fcb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/auth.js:9 
const ssoSuccess = (token) => client.get(`/auth/sso-success?token=${token}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #728f3a8ced056b55 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:5 
const getAllAgentflows = (type, params) => client.get(`/chatflows?type=${type}`, { params })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5f5e4488d96911cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:7 
const getSpecificChatflow = (id) => client.get(`/chatflows/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4560afb6d3e0969f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:9 
const getSpecificChatflowFromPublicEndpoint = (id) => client.get(`/public-chatflows/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2ec3d2c945d735d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:13 
const updateChatflow = (id, body) => client.put(`/chatflows/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4c37a73a9a3551c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:17 
const getIsChatflowStreaming = (id) => client.get(`/chatflows-streaming/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #bacef412b3fbcc43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:19 
const getAllowChatflowUploads = (id) => client.get(`/chatflows-uploads/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #67b6680b8da83fb0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:21 
const getHasChatflowChanged = (id, lastUpdatedDateTime) => client.get(`/chatflows/has-changed/${id}/${lastUpdatedDateTime}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5857cfafb6574685 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:25 
const setWebhookSecret = (id) => client.post(`/chatflows/${id}/webhook-secret`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #fddc62a86d8774a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:29 
const getScheduleStatus = (id) => client.get(`/chatflows/${id}/schedule/status`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #05b39eb297d10660 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:31 
const toggleScheduleEnabled = (id, enabled) => client.patch(`/chatflows/${id}/schedule/enabled`, { enabled })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #609b51a9524de4f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatflows.js:33 
const getScheduleTriggerLogs = (id, params) => client.get(`/chatflows/${id}/schedule/trigger-logs`, { params })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f72934fab629a1e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatmessage.js:4 
    client.get(`/internal-chatmessage/${id}`, { params: { feedback: true, ...params } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f9aea832e25c02ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatmessage.js:6 
    client.get(`/chatmessage/${id}`, { params: { order: 'DESC', feedback: true, ...params } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3a826241c4b6c6c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatmessage.js:7 
const getChatmessageFromPK = (id, params = {}) => client.get(`/chatmessage/${id}`, { params: { order: 'ASC', feedback: true, ...params } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #50c012c44d36f228 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatmessage.js:9 
const abortMessage = (chatflowid, chatid) => client.put(`/chatmessage/abort/${chatflowid}/${chatid}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #12c7d16066be267b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatmessagefeedback.js:3 
const addFeedback = (id, body) => client.post(`/feedback/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #997125c3fea98c24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/chatmessagefeedback.js:4 
const updateFeedback = (id, body) => client.put(`/feedback/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #225942ff0db37d09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/client.js:24 
                const response = await axios.post(`${baseURL}/api/v1/auth/refreshToken`, {}, { withCredentials: true })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e1602fa851ad6eab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/client.js:27 
                    return apiClient.request(originalRequest)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b18103acb010f926 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/config.js:3 
const getConfig = (id) => client.get(`/flow-config/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #eb9af3d3aec65d6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/credentials.js:5 
const getCredentialsByName = (componentCredentialName) => client.get(`/credentials?credentialName=${componentCredentialName}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2ffa4723f19c5c82 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/credentials.js:9 
const getSpecificCredential = (id) => client.get(`/credentials/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5ff7cb56a470b89e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/credentials.js:11 
const getSpecificComponentCredential = (name) => client.get(`/components-credentials/${name}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d94568bfc8bd6175 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/credentials.js:15 
const updateCredential = (id, body) => client.put(`/credentials/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c5e43b909a80a62a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/credentials.js:19 
const revealCredential = (id) => client.get(`/credentials/${id}/reveal`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #438b3b837ce01234 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/custommcpservers.js:5 
const getCustomMcpServer = (id) => client.get(`/custom-mcp-servers/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3ec562ccdb700aa5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/custommcpservers.js:9 
const updateCustomMcpServer = (id, body) => client.put(`/custom-mcp-servers/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #03330ee1f05b01b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/custommcpservers.js:13 
const authorizeCustomMcpServer = (id) => client.post(`/custom-mcp-servers/${id}/authorize`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #61fa4c0b008c478b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/custommcpservers.js:15 
const getCustomMcpServerTools = (id) => client.get(`/custom-mcp-servers/${id}/tools`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #37207efa9afaf6c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/dataset.js:6 
const getDataset = (id, params) => client.get(`/datasets/set/${id}`, { params })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #39f6565b43aaf5e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/dataset.js:8 
const updateDataset = (id, body) => client.put(`/datasets/set/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6adf1f1385bdde01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/dataset.js:13 
const updateDatasetRow = (id, body) => client.put(`/datasets/rows/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #7e533d7d78b7de3b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:5 
const getSpecificDocumentStore = (id) => client.get(`/document-store/store/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #226907252654845f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:7 
const updateDocumentStore = (id, body) => client.put(`/document-store/store/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8aba5f162e205086 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:9 
const getDocumentStoreConfig = (storeId, loaderId) => client.get(`/document-store/store-configs/${storeId}/${loaderId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f3180b20f9f94515 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:14 
    client.put(`/document-store/chunks/${storeId}/${loaderId}/${chunkId}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5cb4c5cb6fd9385d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:16 
const getFileChunks = (storeId, fileId, pageNo) => client.get(`/document-store/chunks/${storeId}/${fileId}/${pageNo}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4fb4836ace6f8c9d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:18 
const processLoader = (body, loaderId) => client.post(`/document-store/loader/process/${loaderId}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4c6dd3898364a5e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:20 
const refreshLoader = (storeId) => client.post(`/document-store/refresh/${storeId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b68c20693bd2ed62 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/documentstore.js:34 
const generateDocStoreToolDesc = (storeId, body) => client.post('/document-store/generate-tool-desc/' + storeId, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9aa872f44ad2c634 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/evaluations.js:5 
const getIsOutdated = (id) => client.get(`/evaluations/is-outdated/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ebf3bfb0335c6cf8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/evaluations.js:6 
const getEvaluation = (id) => client.get(`/evaluations/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3d2314d6593ec5ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/evaluations.js:9 
const runAgain = (id) => client.post(`/evaluations/run-again/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #65d0de457d07c56c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/evaluations.js:10 
const getVersions = (id) => client.get(`/evaluations/versions/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5bac65759945b058 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/evaluators.js:7 
const getEvaluator = (id) => client.get(`/evaluators/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #bfa7b6aaa7919421 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/evaluators.js:8 
const updateEvaluator = (id, body) => client.put(`/evaluators/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #03cbc855e0eb2ec5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/executions.js:5 
const getExecutionById = (executionId) => client.get(`/executions/${executionId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #bacf864be9236dcc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/executions.js:6 
const getExecutionByIdPublic = (executionId) => client.get(`/public-executions/${executionId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ef0c659beeebec56 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/executions.js:7 
const updateExecution = (executionId, body) => client.put(`/executions/${executionId}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9fc1a218b7f83302 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/feedback.js:3 
const getStatsFromChatflow = (id, params) => client.get(`/stats/${id}`, { params: { ...params } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f79b72d4df31a0b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/lead.js:3 
const getLeads = (id) => client.get(`/leads/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3bc321080b76fd09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/log.js:3 
const getLogs = (startDate, endDate) => client.get(`/logs?startDate=${startDate}&endDate=${endDate}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3984e11fe9fdee72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/loginmethod.js:4 
const getLoginMethods = (organizationId) => client.get(`/loginmethod?organizationId=${organizationId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ccaf7ecaa65ccadd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/mcpserver.js:3 
const getMcpServerConfig = (id) => client.get(`/mcp-server/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2ccd866ba63bae5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/mcpserver.js:5 
const createMcpServerConfig = (id, body) => client.post(`/mcp-server/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #40d9f4517b817ab0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/mcpserver.js:7 
const updateMcpServerConfig = (id, body) => client.put(`/mcp-server/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cc7bab01174b60bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/mcpserver.js:11 
const refreshMcpToken = (id) => client.post(`/mcp-server/${id}/refresh`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #084ac46b63ee4386 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/nodes.js:5 
const getSpecificNode = (name) => client.get(`/nodes/${name}`, { params: { client: 'agentflowv2' } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #edd9184cb983b691 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/nodes.js:6 
const getNodesByCategory = (name) => client.get(`/nodes/category/${name}`, { params: { client: 'agentflowv2' } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #49544b327d45b585 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/nodes.js:10 
const executeNodeLoadMethod = (name, body) => client.post(`/node-load-method/${name}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6c151d30532dcd41 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/oauth2.js:3 
const authorize = (credentialId) => client.post(`/oauth2-credential/authorize/${credentialId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #dea424a2bbd8f6f3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/oauth2.js:5 
const refresh = (credentialId) => client.post(`/oauth2-credential/refresh/${credentialId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a97301987e25a4be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/oauth2.js:7 
const getCallback = (queryParams) => client.get(`/oauth2-credential/callback?${queryParams}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #05c8be984b242ef1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/prediction.js:3 
const sendMessageAndGetPrediction = (id, input) => client.post(`/internal-prediction/${id}`, input)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ea9915de3a763c84 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/prediction.js:4 
const sendMessageAndStreamPrediction = (id, input) => client.post(`/internal-prediction/stream/${id}`, input)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d5a2b30ee7dca431 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/prediction.js:5 
const sendMessageAndGetPredictionPublic = (id, input) => client.post(`/prediction/${id}`, input)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6dd74d1a33f61348 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/role.js:3 
const getAllRolesByOrganizationId = (organizationId) => client.get(`/role?organizationId=${organizationId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #808dafc258d832d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/role.js:4 
const getRoleById = (id) => client.get(`/auth/roles/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d6bd2942e2ed0f93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/role.js:7 
const getRoleByName = (name) => client.get(`/auth/roles/name/${name}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3e4ad99bbda8ad75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/scraper.js:4 
    client.get(`/fetch-links?url=${encodeURIComponent(url)}&relativeLinksMethod=${relativeLinksMethod}&limit=${relativeLinksLimit}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e2badfe02e02e30b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/sso.js:3 
const ssoLogin = (providerName) => client.get(`/${providerName}/login`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3e7102ea98307e85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/tools.js:5 
const getSpecificTool = (id) => client.get(`/tools/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d11fb961d9fc1bc0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/tools.js:9 
const updateTool = (id, body) => client.put(`/tools/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #139f9b9190b24866 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:4 
const getUserById = (id) => client.get(`/user?id=${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #903b04372d93c32a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:8 
const getAllUsersByOrganizationId = (organizationId) => client.get(`/organizationuser?organizationId=${organizationId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #abd19cd4f5adae66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:10 
    client.get(`/organizationuser?organizationId=${organizationId}&userId=${userId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #23611d2458fc12d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:11 
const getOrganizationsByUserId = (userId) => client.get(`/organizationuser?userId=${userId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #98d993105efbf91d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:17 
    client.get(`/organization/additional-seats-quantity?subscriptionId=${subscriptionId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d725f690fd029a78 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:18 
const getCustomerDefaultSource = (customerId) => client.get(`/organization/customer-default-source?customerId=${customerId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #20cff2bcbf742a97 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:20 
    client.get(`/organization/additional-seats-proration?subscriptionId=${subscriptionId}&quantity=${quantity}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #281cbb138027cb4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:24 
    client.get(`/organization/plan-proration?subscriptionId=${subscriptionId}&newPlanId=${newPlanId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #32b04a4a0d905b6b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:30 
const getAllUsersByWorkspaceId = (workspaceId) => client.get(`/workspaceuser?workspaceId=${workspaceId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #25c9314680c3db8a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:31 
const getUserByRoleId = (roleId) => client.get(`/workspaceuser?roleId=${roleId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9509bed7fa1729f4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:32 
const getUserByUserIdWorkspaceId = (userId, workspaceId) => client.get(`/workspaceuser?userId=${userId}&workspaceId=${workspaceId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #bb6eececfaca5686 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:33 
const getWorkspacesByUserId = (userId) => client.get(`/workspaceuser?userId=${userId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3a6afe714ed7a08c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/user.js:35 
    client.get(`/workspaceuser?organizationId=${organizationId}&userId=${userId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1858480b6738908f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/validation.js:3 
const checkValidation = (id) => client.get(`/validation/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1bdc8a1df12ba807 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/variables.js:7 
const updateVariable = (id, body) => client.put(`/variables/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #dfa6120274075322 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/vectorstore.js:3 
const upsertVectorStore = (id, input) => client.post(`/vector/internal-upsert/${id}`, input)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1dc18685773e31e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/vectorstore.js:5 
    client.post(`/vector/internal-upsert/${id}`, formData, {
        headers: { 'Content-Type': 'multipart/form-data' }
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #76f12615a3d3a08d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/vectorstore.js:8 
const getUpsertHistory = (id, params = {}) => client.get(`/upsert-history/${id}`, { params: { order: 'DESC', ...params } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #46afe015ae01b83d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/webhooklistener.js:3 
const register = (chatflowid) => client.post(`/webhook-listener/${chatflowid}/register`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #84837aa96da09a39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/workspace.js:3 
const getAllWorkspacesByOrganizationId = (organizationId) => client.get(`/workspace?organizationId=${organizationId}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #988125cc0174fd52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/workspace.js:5 
const getWorkspaceById = (id) => client.get(`/workspace?id=${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cfd34ed0a83ab3b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/workspace.js:7 
const unlinkUsers = (id, body) => client.post(`/workspace/unlink-users/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6207810505039ae8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/workspace.js:8 
const linkUsers = (id, body) => client.post(`/workspace/link-users/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ad41d898ea3cd1f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/workspace.js:10 
const switchWorkspace = (id) => client.post(`/workspace/switch?id=${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #35aa97a0cef4f9f7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/workspace.js:16 
const getSharedWorkspacesForItem = (id) => client.get(`/workspace/shared/${id}`)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a3bed19092d157eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/api/workspace.js:17 
const setSharedWorkspacesForItem = (id, body) => client.post(`/workspace/shared/${id}`, body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0856bc733e1dc750 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/OrgWorkspaceBreadcrumbs/index.jsx:123 
        getWorkspacesByUserIdApi.request(user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3bb9be0ac10e98d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/OrgWorkspaceBreadcrumbs/index.jsx:140 
            getWorkspacesByUserIdApi.request(user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #086327e50f887b7e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/OrgWorkspaceBreadcrumbs/index.jsx:169 
            switchWorkspaceApi.request(id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #fca64e92c00a37f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/OrgWorkspaceBreadcrumbs/index.jsx:176 
            getOrganizationsByUserIdApi.request(user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1fca018eef51fcb0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/OrgWorkspaceBreadcrumbs/index.jsx:207 
                switchWorkspaceApi.request(sortedWorkspaces[0].id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ecc14bccf633f3e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/OrgWorkspaceBreadcrumbs/index.jsx:240 
            getWorkspacesByUserIdApi.request(user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #650c77a8143682b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/ProfileSection/index.jsx:281 
            importAllApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8705ecea1e890de9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/ProfileSection/index.jsx:323 
        exportAllApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #97607616c05fccc3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/WorkspaceSwitcher/index.jsx:104 
        getWorkspacesByOrganizationIdUserIdApi.request(user.activeOrganizationId, user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9ff0de1ce9a720d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/WorkspaceSwitcher/index.jsx:115 
            switchWorkspaceApi.request(id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #7b7a2df8c87ef9d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/WorkspaceSwitcher/index.jsx:131 
                        getWorkspacesByOrganizationIdUserIdApi.request(user.activeOrganizationId, user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2ee375277fa4aaa2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/WorkspaceSwitcher/index.jsx:133 
                        getWorkspacesByUserIdApi.request(user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2bebd53e7c9c2834 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/ui/src/layout/MainLayout/Header/index.jsx:202 
                    const response = await fetch('https://api.github.com/repos/FlowiseAI/Flowise')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #be7b82d1e398b305 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/serviceWorker.js:66 
    fetch(swUrl, {
        headers: { 'Service-Worker': 'script' }
    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #24acb3167dc8d7e8 — Environment-variable access.
repo/packages/ui/src/serviceWorker.js:90 
    if (process.env.NODE_ENV === 'production' && 'serviceWorker' in navigator) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d1059170a754d4aa — Environment-variable access.
repo/packages/ui/src/serviceWorker.js:92 
        const publicUrl = new URL(process.env.PUBLIC_URL, window.location.href)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1b92182452524e55 — Environment-variable access.
repo/packages/ui/src/serviceWorker.js:101 
            const swUrl = `${process.env.PUBLIC_URL}/service-worker.js`

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #1b39a187c430dce8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/button/FlowListMenu.jsx:116 
                await updateFlowsApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6fe8411c16c3da74 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/button/FlowListMenu.jsx:186 
            await updateChatflowApi.request(chatflow.id, updateBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8379d15e63effed1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/button/FlowListMenu.jsx:196 
                await updateFlowsApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0c7ce9b2a326222c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/button/FlowListMenu.jsx:235 
            await updateChatflowApi.request(chatflow.id, updateBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #830df8ad928ddd93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/button/FlowListMenu.jsx:243 
                await updateFlowsApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #54d624cc83734485 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/button/FlowListMenu.jsx:285 
                    await updateFlowsApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c6ca2d1cbc5c2bc8 — Hardcoded external endpoint. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/AboutDialog.jsx:16 
            const latestReleaseReq = axios.get('https://api.github.com/repos/FlowiseAI/Flowise/releases/latest')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2454c35e63d14174 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/AboutDialog.jsx:17 
            const currentVersionReq = axios.get(`${baseURL}/api/v1/version`, {
                withCredentials: true,
                headers: { 'Content-type': 'application/json', 'x-request-from': 'internal' }
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #fe0853b004d7b549 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ExpandTextDialog.jsx:169 
                            executeCustomFunctionNodeApi.request({ javascriptFunction: inputValue })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a79814346c5581c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ExportAsTemplateDialog.jsx:133 
        saveCustomTemplateApi.request(template)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #35f547c35ec79981 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/InviteUsersDialog.jsx:192 
        getAllRolesApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #056407bbec3ee53f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/InviteUsersDialog.jsx:193 
        getAllWorkspacesByOrganizationIdApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5372ef815aa16621 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/InviteUsersDialog.jsx:211 
            getWorkspacesByUserIdApi.request(dialogProps.data.userId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4254e26c3c11a050 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/NodeInfoDialog.jsx:36 
            getNodeConfigApi.request(dialogProps.data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1ace72e3982abdbf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/PromptLangsmithHubDialog.jsx:99 
            getAvailablePromptsApi.request({ tags: promptType === 'template' ? 'StringPromptTemplate&' : 'ChatPromptTemplate&' })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #80fb133ab10a1ae9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/PromptLangsmithHubDialog.jsx:210 
        getAvailablePromptsApi.request({ tags: tags })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #512426319920bc4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ShareWithWorkspaceDialog.jsx:105 
            getWorkspacesByOrganizationIdUserIdApi.request(user.activeOrganizationId, user.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #425680331361eea0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ShareWithWorkspaceDialog.jsx:108 
        getSharedWorkspacesForItemApi.request(dialogProps.data.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e534c834a5a60fec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewLeadsDialog.jsx:98 
            getLeadsApi.request(dialogProps.chatflow.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #68785abadccabcd8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:220 
        getChatmessageApi.request(dialogProps.chatflow.id, {
            chatType: chatTypes.length ? chatTypes : undefined,
            feedbackType: feedbackTypes.length ? feedbackTypes : undefined,
            startDate: startDate,
            endDate: endDate,
            order: 'DESC',
            page: page,
            limit: limit
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #7e94c68c7e61de4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:229 
        getStatsApi.request(dialogProps.chatflow.id, {
            chatType: chatTypes.length ? chatTypes : undefined,
            feedbackType: feedbackTypes.length ? feedbackTypes : undefined,
            startDate: startDate,
            endDate: endDate
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #147fb388de2d4c6b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:451 
                getChatmessageApi.request(chatflowid, {
                    startDate: startDate,
                    endDate: endDate,
                    chatType: chatTypeFilter.length ? chatTypeFilter : undefined,
                    feedbackType: feedbackTypeFilter.length ? feedbackTypeFilter : undefined
                })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #88657f62b962bd9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:457 
                getStatsApi.request(chatflowid, {
                    startDate: startDate,
                    endDate: endDate,
                    chatType: chatTypeFilter.length ? chatTypeFilter : undefined,
                    feedbackType: feedbackTypeFilter.length ? feedbackTypeFilter : undefined
                })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #21251215d0b69c72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:613 
            getChatmessageFromPKApi.request(dialogProps.chatflow.id, {
                ...transformChatPKToParams(getChatPK(chatmsg)),
                feedbackType: feedbackTypeFilter
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ecc86f948504ea6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:618 
            getChatmessageFromPKApi.request(dialogProps.chatflow.id, transformChatPKToParams(getChatPK(chatmsg)))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #27937a82781d00d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:628 
            const response = await axios.post(
                `${baseURL}/api/v1/openai-assistants-file/download`,
                { fileName: fileAnnotation.fileName, chatflowId: dialogProps.chatflow.id, chatId: selectedChatId },
                { responseType: 'blob' }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8331f0f7ee89ddad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:733 
                    getChatmessageFromPKApi.request(dialogProps.chatflow.id, {
                        ...transformChatPKToParams(chatPK),
                        feedbackType: feedbackTypeFilter
                    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #69f3e4aa3eca7cc1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:738 
                    getChatmessageFromPKApi.request(dialogProps.chatflow.id, transformChatPKToParams(chatPK))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #509942136f474a77 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dialog/ViewMessagesDialog.jsx:756 
            getStatsApi.request(dialogProps.chatflow.id, {
                startDate: startDate,
                endDate: endDate
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #622196b70008f70f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/dropdown/AsyncDropdown.jsx:48 
    let lists = await axios
        .post(
            `${baseURL}/api/v1/node-load-method/${nodeData.name}`,
            { ...nodeData, loadMethod, previousNodes, currentNode, credential: credentialId },
            config
        )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #941f4c5d7fbe6308 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/extended/AudioWaveform.jsx:117 
                    const response = await fetch(audioSrc)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #fa96b760149bcc5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/extended/McpServer.jsx:201 
            getMcpServerConfigApi.request(dialogProps.chatflow.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d82092ae4bca4680 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/extended/OverrideConfig.jsx:375 
            getConfigApi.request(dialogProps.chatflow.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3f5894e25f2ccdfa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/subscription/PricingDialog.jsx:53 
        getAdditionalSeatsQuantityApi.request(currentUser?.activeOrganizationSubscriptionId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #05cd7239a60459b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/subscription/PricingDialog.jsx:66 
        getCustomerDefaultSourceApi.request(currentUser?.activeOrganizationCustomerId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #511bb369fac5d28c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/subscription/PricingDialog.jsx:141 
            getPlanProrationApi.request(currentUser.activeOrganizationSubscriptionId, selectedPlan.prodId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #be3c30fc807d9b2e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/subscription/PricingDialog.jsx:181 
                getAllWorkspacesApi.request(currentUser?.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #32943fb88427b5f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/ui-component/subscription/PricingDialog.jsx:182 
                getAllAPIKeysApi.request({ type: 'organization' })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #deea6fa397fd26f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/account/index.jsx:112 
            getUserByIdApi.request(currentUser.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #57c228a90c387b19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/account/index.jsx:122 
            getAdditionalSeatsQuantityApi.request(currentUser?.activeOrganizationSubscriptionId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c6ca0ae56e40e4c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/account/index.jsx:170 
            getCustomerDefaultSourceApi.request(currentUser?.activeOrganizationCustomerId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cff043ce8e349967 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/account/index.jsx:377 
            await updateAdditionalSeatsApi.request(
                currentUser?.activeOrganizationSubscriptionId,
                newSeatsAmount,
                prorationInfo.prorationDate
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b8f7c2b54a6eab14 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/account/index.jsx:395 
            getAdditionalSeatsQuantityApi.request(currentUser?.activeOrganizationSubscriptionId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b269d81a022580bf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/account/index.jsx:427 
            getAdditionalSeatsProrationApi.request(currentUser.activeOrganizationSubscriptionId, totalAdditionalSeats)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c06f115b90fd0efb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/account/index.jsx:1526 
                        onClick={() => deleteAccountApi.request({ confirmationText: deleteConfirmationText })}

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #28ee63114f7af2d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/ExecutionDetails.jsx:638 
        updateExecutionApi.request(localMetadata.id, { isPublic: newIsPublic }).then(() => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #fb49cc4580d6883f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/ExecutionDetails.jsx:959 
                    updateExecutionApi.request(localMetadata.id, { isPublic: false }).then(() => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #21f9ad040168bab3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/NodeExecutionDetails.jsx:182 
            const response = await axios.post(
                `${baseURL}/api/v1/openai-assistants-file/download`,
                { fileName: fileAnnotation.fileName, chatflowId: metadata?.agentflowId, chatId: metadata?.sessionId },
                { responseType: 'blob' }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b295a58451c981c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/PublicExecutionDetails.jsx:30 
        getExecutionByIdPublicApi.request(executionId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6fecbeb95345d247 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/PublicExecutionDetails.jsx:95 
                                getExecutionByIdPublicApi.request(executionId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #749c4244f013e8b0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/PublicExecutionDetails.jsx:98 
                                getExecutionByIdPublicApi.request(executionId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0e33ee50cd1d4c37 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/ShareExecutionDialog.jsx:59 
        updateExecutionApi.request(executionId, { isPublic: false })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8e5bcc3e6d5d0f19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/index.jsx:171 
        deleteExecutionsApi.request(selectedExecutionIds)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8a61225c97a6f27e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentexecutions/index.jsx:417 
                                    getExecutionByIdApi.request(executionId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #21cf6597cdc04de1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentflowsv2/Canvas.jsx:247 
                createNewChatflowApi.request(newChatflowBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #539eb046ccac091e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentflowsv2/Canvas.jsx:253 
                updateChatflowApi.request(chatflow.id, updateBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f190ac16af210c10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/agentflowsv2/Canvas.jsx:595 
            getSpecificChatflowApi.request(chatflowId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8b0eeaa694b3b150 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/apikey/index.jsx:253 
        getAllAPIKeysApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d4d2718dcbb4631c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/custom/CustomAssistantConfigurePreview.jsx:746 
                getSpecificAssistantApi.request(customAssistantId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #dd912d258c5768fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/custom/CustomAssistantConfigurePreview.jsx:770 
                    getSpecificChatflowApi.request(assistantDetails.flowId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #76601e3eb5be0c71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/openai/AssistantDialog.jsx:268 
            getSpecificAssistantApi.request(dialogProps.assistantId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b16902fd48aed333 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/openai/AssistantDialog.jsx:275 
            getAssistantObjApi.request(dialogProps.selectedOpenAIAssistantId, dialogProps.credential)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #53f5dc6ea92d5bb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/openai/AssistantVectorStoreDialog.jsx:111 
            getAssistantVectorStoreApi.request(dialogProps.data.id, dialogProps.credential)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #60c5a18e3bea21c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/openai/AssistantVectorStoreDialog.jsx:112 
            listAssistantVectorStoreApi.request(dialogProps.credential)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e903194eef4a65fe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/openai/AssistantVectorStoreDialog.jsx:114 
            listAssistantVectorStoreApi.request(dialogProps.credential)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0a2dea6930e9891c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/openai/AssistantVectorStoreDialog.jsx:304 
                                getAssistantVectorStoreApi.request(newValue, dialogProps.credential)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d594de315063f780 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/assistants/openai/LoadAssistantDialog.jsx:80 
                            if (newValue) getAllAvailableAssistantsApi.request(newValue)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2a5d4179b853efdf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/confirm-email-change.jsx:56 
            confirmApi.request({ user: { tempToken: token } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1122c78d82f08f89 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/forgotPassword.jsx:58 
        await forgotPasswordApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #551be74f7e820c4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/loginActivity.jsx:123 
        getLoginActivityApi.request({
            pageNo: _page,
            startDate: _start,
            endDate: _end,
            activityCodes: activityCodes
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #6b4bd67c9b907326 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/loginActivity.jsx:185 
        getLoginActivityApi.request({
            pageNo: 1
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8c01045f9fd0117e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/register.jsx:145 
                await registerApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #942abda879354783 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/register.jsx:171 
                await registerApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a38e3c5072f88925 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/signIn.jsx:84 
        loginApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b914309264863f4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/signIn.jsx:170 
            await resendVerificationApi.request({ email: usernameVal })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8dbf23d8098ac8e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/ssoConfig.jsx:406 
        getLoginMethodsApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ab04c8d9bc8054c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/auth/verify-email.jsx:58 
            accountVerifyApi.request({ user: { tempToken: token } })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3fdfbfc4f9157386 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/canvas/CanvasHeader.jsx:274 
            updateChatflowApi.request(chatflow.id, updateBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #555195d39688fc24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/canvas/CanvasHeader.jsx:359 
            getScheduleStatusApi.request(chatflow.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #669e5a66b90865aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/canvas/CanvasHeader.jsx:396 
        toggleScheduleEnabledApi.request(chatflow.id, newEnabled)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #102734dfcf884dcb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/canvas/index.jsx:238 
                createNewChatflowApi.request(newChatflowBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #982265b16c2fcafe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/canvas/index.jsx:242 
                getHasChatflowChangedApi.request(chatflow.id, lastUpdatedDateTime)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4cfa31556f96a6c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/canvas/index.jsx:476 
            updateChatflowApi.request(chatflow.id, updateBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9fb22d47f39041d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/canvas/index.jsx:502 
            getSpecificChatflowApi.request(chatflowId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #40682c8aae0695a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatbot/index.jsx:34 
        getSpecificChatflowFromPublicApi.request(chatflowId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4fe9e0972b4de106 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatflows/APICodeDialog.jsx:169 
            getConfigApi.request(dialogProps.chatflowid)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #dfa17becf51fba95 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatflows/APICodeDialog.jsx:185 
        updateChatflowApi.request(dialogProps.chatflowid, updateBody)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e258eb295a182286 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatflows/APICodeDialog.jsx:765 
            getIsChatflowStreamingApi.request(dialogProps.chatflowid)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ea2a88d563236e45 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatflows/index.jsx:64 
        getAllChatflowsApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #7968cbec741d5049 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatmessage/ChatMessage.jsx:1284 
            const response = await axios.post(
                `${baseURL}/api/v1/openai-assistants-file/download`,
                { fileName: fileAnnotation.fileName, chatflowId: chatflowid, chatId: chatId },
                { responseType: 'blob' }
            )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #203a375824c978c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatmessage/ChatMessage.jsx:1434 
                    getAllExecutionsApi.request({ agentflowId: chatflowid })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #08077892dc114de0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatmessage/ChatMessage.jsx:1541 
            getChatmessageApi.request(chatflowid)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9dd90bac481a94d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/chatmessage/ChatMessage.jsx:1542 
            getIsChatflowStreamingApi.request(chatflowid)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #46c81c10c82873c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/credentials/AddEditCredentialDialog.jsx:73 
                getSpecificComponentCredentialApi.request(getSpecificCredentialApi.data.credentialName)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8ea6ad63e803e390 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/credentials/AddEditCredentialDialog.jsx:104 
            getSpecificCredentialApi.request(dialogProps.data.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c1f040a80b5e31b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/credentials/AddEditCredentialDialog.jsx:107 
            getSpecificCredentialApi.request(dialogProps.credentialId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c1160fe424b155dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/datasets/DatasetItems.jsx:131 
        reorderDatasetRowApi.request({ datasetId: datasetId, rows: updatedRows })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #91b84628f8e598b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/DeleteDocStoreDialog.jsx:60 
            if (nodeName) getRecordManagerNodeApi.request(nodeName)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #19eabf9f7f67fd54 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/DeleteDocStoreDialog.jsx:65 
            if (nodeName) getVectorStoreNodeApi.request(nodeName)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4b11e78e4149c5f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/DocStoreAPIDialog.jsx:307 
            getConfigApi.request(dialogProps.storeId, dialogProps.loaderId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #882a8195a805c2ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/LoaderConfigPreviewChunks.jsx:299 
            getSpecificDocumentStoreApi.request(storeId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #acea60b0f744e699 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/LoaderConfigPreviewChunks.jsx:301 
            getNodeDetailsApi.request(docLoaderNodeName)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #00a282f1ca3ec04a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/LoaderConfigPreviewChunks.jsx:374 
                    getNodeDetailsApi.request(loader.loaderId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #53c2515083356519 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/ShowStoredChunks.jsx:119 
                getChunksApi.request(storeId, fileId, currentPage)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #79610c5dbf516ece — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/ShowStoredChunks.jsx:168 
                    getChunksApi.request(storeId, fileId, currentPage)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cf60a11740f4328f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/ShowStoredChunks.jsx:193 
        getChunksApi.request(storeId, fileId, currentPage)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f3dea39ea034b83e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/ShowStoredChunks.jsx:200 
        getChunksApi.request(storeId, fileId, newPage)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f6a0c6c1c6dbd857 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/UpsertHistorySideDrawer.jsx:28 
        getUpsertHistoryApi.request(dialogProps.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d7dffcf6117dc84e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreConfigure.jsx:307 
            insertIntoVectorStoreApi.request(data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #da326076eac24032 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreConfigure.jsx:314 
        saveVectorStoreConfigApi.request(data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #72dba4a841e9fa0f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreConfigure.jsx:436 
        getSpecificDocumentStoreApi.request(storeId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ae5b7997f0094118 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreConfigure.jsx:459 
                getEmbeddingNodeDetailsApi.request(docStore.embeddingConfig.name)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #65eebc40db2e54ca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreConfigure.jsx:462 
                getVectorStoreNodeDetailsApi.request(docStore.vectorStoreConfig.name)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #719e9f668a35a96d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreConfigure.jsx:465 
                getRecordManagerNodeDetailsApi.request(docStore.recordManagerConfig.name)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a707bd6aae1d188a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreQuery.jsx:130 
        queryVectorStoreApi.request(data)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #826331f9d4a9c640 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreQuery.jsx:235 
        getSpecificDocumentStoreApi.request(storeId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3c4f256d4c4c253c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/docstore/VectorStoreQuery.jsx:249 
                getVectorStoreNodeDetailsApi.request(vectorStoreConfig.name)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #8c0457ea1a0729fc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/evaluations/CreateEvaluationDialog.jsx:345 
        if (llm !== 'no_grading') getModelsApi.request(llm, { loadMethod: 'listModels' })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f5d53beda265880f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/evaluations/EvaluationResult.jsx:193 
            runAgainApi.request(evaluation?.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #3d0ec942c788fedf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/evaluations/EvaluationResult.jsx:246 
            getIsOutdatedApi.request(data.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #20942a499b4e0194 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/evaluations/EvaluationResultVersionsSideDrawer.jsx:28 
        getVersionsApi.request(dialogProps.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f7afbbb004927c98 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/organization/index.jsx:132 
            await registerAccountApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #27bfc90952bd628a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/organization/index.jsx:184 
                loginApi.request(body)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4cdd28d47487d2a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/roles/index.jsx:242 
            getAllUsersByRoleIdApi.request(selectedRoleId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e624e80cf2f8c7be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/roles/index.jsx:510 
        getAllRolesByOrganizationIdApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #04023c28722befbc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/roles/index.jsx:514 
        getAllRolesByOrganizationIdApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #daa00fe94e272d4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/schedule/ScheduleHistoryDrawer.jsx:267 
        statusApi.request(chatflowid)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #cd1b064cd4db4932 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/schedule/ScheduleHistoryDrawer.jsx:268 
        logsApi.request(chatflowid, { page, limit })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b7c88daaabefce12 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/schedule/ScheduleHistoryDrawer.jsx:728 
                    onRefresh={() => execApi.request(executionMetadata?.id)}

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #5f058d25da793b5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/schedule/ScheduleHistoryFAB.jsx:23 
        const tick = () => probeApi.request(chatflowid, { page: 1, limit: 5, status: 'RUNNING' })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #2a3102414b493b83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:136 
                getLogsApi.request(subtractTime(0, 0, 1), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #11023afec153103f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:139 
                getLogsApi.request(subtractTime(0, 0, 4), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #99e8e94f57aab8f7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:142 
                getLogsApi.request(subtractTime(0, 0, 24), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #e27135774a52a4ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:145 
                getLogsApi.request(subtractTime(0, 2, 0), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4d082ffea931445b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:148 
                getLogsApi.request(subtractTime(0, 7, 0), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #bf6ec20fee13eb4b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:151 
                getLogsApi.request(subtractTime(0, 14, 0), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #b0cd0b64806940cc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:154 
                getLogsApi.request(subtractTime(1, 0, 0), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1c16622add47616c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:157 
                getLogsApi.request(subtractTime(2, 0, 0), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #336e3b5e830aaee2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:160 
                getLogsApi.request(subtractTime(3, 0, 0), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4ae2346e5adc7044 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:165 
                getLogsApi.request(subtractTime(0, 0, 1), getDateTimeFormatted())

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #66b3368c2385dd9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:174 
        getLogsApi.request(getDateTimeFormatted(date), getDateTimeFormatted(endDate))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1d6984ec451d7490 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:179 
        getLogsApi.request(getDateTimeFormatted(startDate), getDateTimeFormatted(date))

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #c93ff9d0f3295639 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/serverlogs/index.jsx:185 
        getLogsApi.request(startTimeFormatted, currentTimeFormatted)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #218844709d53f13b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/tools/ToolDialog.jsx:205 
            getSpecificToolApi.request(dialogProps.toolId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #270933822c21edc6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/tools/index.jsx:74 
        getAllToolsApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9f0534c47ca76b21 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/tools/index.jsx:88 
        getAllCustomMcpServersApi.request(params)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #977a244db3895206 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/users/index.jsx:366 
        getAllUsersByOrganizationIdApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #d05b98ccfa11988e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/users/index.jsx:370 
        getAllUsersByOrganizationIdApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1a98b0e0b4720467 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/vectorstore/UpsertHistoryDialog.jsx:217 
        getUpsertHistoryApi.request(dialogProps.chatflow.id, {
            startDate: updatedDate,
            endDate: endDate
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #f136fdc289ce0e58 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/vectorstore/UpsertHistoryDialog.jsx:227 
        getUpsertHistoryApi.request(dialogProps.chatflow.id, {
            endDate: updatedDate,
            startDate: startDate
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #200d126d33d3f49e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/vectorstore/UpsertHistoryDialog.jsx:296 
            getUpsertHistoryApi.request(dialogProps.chatflow.id)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #78add0b737a22ca5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/vectorstore/VectorStoreDialog.jsx:288 
        if (checkboxNodes[vectorNodeId] === true) getConfigApi.request(dialogProps.chatflowid)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #9b473579b0a39102 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/EditWorkspaceUserRoleDialog.jsx:90 
            getAllRolesApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #fe800e8ed4d0f851 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/WorkspaceUsers.jsx:256 
        getAllUsersByWorkspaceIdApi.request(workspaceId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #4b05b97674f3446e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/WorkspaceUsers.jsx:271 
        getWorkspaceByIdApi.request(workspaceId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #816200b73f51c506 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/WorkspaceUsers.jsx:272 
        getAllUsersByWorkspaceIdApi.request(workspaceId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ffe82d578bb681d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/index.jsx:86 
            getAllUsersByWorkspaceIdApi.request(selectedWorkspaceId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #fd322b154b2cd0f4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/index.jsx:330 
        getAllWorkspacesApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #79123aacbd4fbeb7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/index.jsx:341 
            switchWorkspaceApi.request(workspaceId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #0e602e9790d48a01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/index.jsx:344 
            switchWorkspaceApi.request(specificWorkspaceId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #1d4cb80a45a7acdb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/packages/ui/src/views/workspace/index.jsx:394 
        getAllWorkspacesApi.request(currentUser.activeOrganizationId)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs test-only Excluded from app score #4b140c27cdae172c — Environment-variable access.
repo/packages/ui/vite.config.js:47 
            port: process.env.VITE_PORT ?? 8080,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #56e6334d4ddd772f — Environment-variable access.
repo/packages/ui/vite.config.js:48 
            host: process.env.VITE_HOST

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

axios

npm dependency
high pii_flow dependency Excluded from app score #1f6337adee0eb4d0 — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent.
pkgs/npm/[email protected]/lib/adapters/http.js:708 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/lib/adapters/http.js:611 → /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/lib/adapters/http.js:708 
      req = transport.request(options, function handleResponse(res) {
        if (req.destroyed) return;

        const streams = [res];

        const responseLength = utils.toFiniteNumber(res.headers['content-length']);

        if (onDownloadProgress || maxDownloadRate) {
          const transformStream = new AxiosTransformStream({
            maxRate: utils.toFiniteNumber(maxDownloadRate),
          });

          onDownloadProgress &&
            transformStream.on(
              'progress',
              flushOnFinish(
                transformStream,
                progressEventDecorator(
                  responseLength,
                  progressEventReducer(asyncDecorator(onDownloadProgress), true, 3)
                )
              )
            );

          streams.push(transformStream);
        }

        // decompress the response body transparently if required
        let responseStream = res;

        // return the last request in case of redirects
        const lastRequest = res.req || req;

        // if decompress disabled we should not decompress
        if (config.decompress !== false && res.headers['content-encoding']) {
          // if no content, but headers still say that it is encoded,
          // remove the header not confuse downstream operations
          if (method === 'HEAD' || res.statusCode === 204) {
            delete res.headers['content-encoding'];
          }

          switch ((res.headers['content-encoding'] || '').toLowerCase()) {
            /*eslint default-case:0*/
            case 'gzip':
            case 'x-gzip':
            case 'compress':
            case 'x-compress':
              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'deflate':
              streams.push(new ZlibHeaderTransformStream());

              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'br':
              if (isBrotliSupported) {
                streams.push(zlib.createBrotliDecompress(brotliOptions));
                delete res.headers['content-encoding'];
              }
          }
        }

        responseStream = streams.length > 1 ? stream.pipeline(streams, utils.noop) : streams[0];

        const response = {
          status: res.statusCode,
          statusText: res.statusMessage,
          headers: new AxiosHeaders(res.headers),
          config,
          request: lastRequest,
        };

        if (responseType === 'stream') {
          response.data = responseStream;
          settle(resolve, reject, response);
        } else {
          const responseBuffer = [];
          let totalResponseBytes = 0;

          responseStream.on('data', function handleStreamData(chunk) {
            responseBuffer.push(chunk);
            totalResponseBytes += chunk.length;

            // make sure the content length is not over the maxContentLength if specified
            if (config.maxContentLength > -1 && totalResponseBytes > config.maxContentLength) {
              // stream.destroy() emit aborted event before calling reject() on Node.js v16
              rejected = true;
              responseStream.destroy();
              abort(
                new AxiosError(
                  'maxContentLength size of ' + config.maxContentLength + ' exceeded',
                  AxiosError.ERR_BAD_RESPONSE,
                  config,
                  lastRequest
                )
              );
            }
          });

          responseStream.on('aborted', function handlerStreamAborted() {
            if (rejected) {
              return;
            }

            const err = new AxiosError(
              'stream has been aborted',
              AxiosError.ERR_BAD_RESPONSE,
              config,
              lastRequest
            );
            responseStream.destroy(err);
            reject(err);
          });

          responseStream.on('error', function handleStreamError(err) {
            if (req.destroyed) return;
            reject(AxiosError.from(err, null, config, lastRequest));
          });

          responseStream.on('end', function handleStreamEnd() {
            try {
              let responseData =
                responseBuffer.length === 1 ? responseBuffer[0] : Buffer.concat(responseBuffer);
              if (responseType !== 'arraybuffer') {
                responseData = responseData.toString(responseEncoding);
                if (!responseEncoding || responseEncoding === 'utf8') {
                  responseData = utils.stripBOM(responseData);
                }
              }
              response.data = responseData;
            } catch (err) {
              return reject(AxiosError.from(err, null, config, response.request, response));
            }
            settle(resolve, reject, response);
          });
        }

        abortEmitter.once('abort', (err) => {
          if (!responseStream.destroyed) {
            responseStream.emit('error', err);
            responseStream.destroy();
          }
        });
      });

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
medium pii_flow dependency Excluded from app score #a8ed654b89fa5207 — Credentials parsed from the request URL are applied as authorization on the same outbound HTTP request. This is intentional URL authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/lib/adapters/http.js:708 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/lib/adapters/http.js:616 → /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/lib/adapters/http.js:708 
      req = transport.request(options, function handleResponse(res) {
        if (req.destroyed) return;

        const streams = [res];

        const responseLength = utils.toFiniteNumber(res.headers['content-length']);

        if (onDownloadProgress || maxDownloadRate) {
          const transformStream = new AxiosTransformStream({
            maxRate: utils.toFiniteNumber(maxDownloadRate),
          });

          onDownloadProgress &&
            transformStream.on(
              'progress',
              flushOnFinish(
                transformStream,
                progressEventDecorator(
                  responseLength,
                  progressEventReducer(asyncDecorator(onDownloadProgress), true, 3)
                )
              )
            );

          streams.push(transformStream);
        }

        // decompress the response body transparently if required
        let responseStream = res;

        // return the last request in case of redirects
        const lastRequest = res.req || req;

        // if decompress disabled we should not decompress
        if (config.decompress !== false && res.headers['content-encoding']) {
          // if no content, but headers still say that it is encoded,
          // remove the header not confuse downstream operations
          if (method === 'HEAD' || res.statusCode === 204) {
            delete res.headers['content-encoding'];
          }

          switch ((res.headers['content-encoding'] || '').toLowerCase()) {
            /*eslint default-case:0*/
            case 'gzip':
            case 'x-gzip':
            case 'compress':
            case 'x-compress':
              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'deflate':
              streams.push(new ZlibHeaderTransformStream());

              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'br':
              if (isBrotliSupported) {
                streams.push(zlib.createBrotliDecompress(brotliOptions));
                delete res.headers['content-encoding'];
              }
          }
        }

        responseStream = streams.length > 1 ? stream.pipeline(streams, utils.noop) : streams[0];

        const response = {
          status: res.statusCode,
          statusText: res.statusMessage,
          headers: new AxiosHeaders(res.headers),
          config,
          request: lastRequest,
        };

        if (responseType === 'stream') {
          response.data = responseStream;
          settle(resolve, reject, response);
        } else {
          const responseBuffer = [];
          let totalResponseBytes = 0;

          responseStream.on('data', function handleStreamData(chunk) {
            responseBuffer.push(chunk);
            totalResponseBytes += chunk.length;

            // make sure the content length is not over the maxContentLength if specified
            if (config.maxContentLength > -1 && totalResponseBytes > config.maxContentLength) {
              // stream.destroy() emit aborted event before calling reject() on Node.js v16
              rejected = true;
              responseStream.destroy();
              abort(
                new AxiosError(
                  'maxContentLength size of ' + config.maxContentLength + ' exceeded',
                  AxiosError.ERR_BAD_RESPONSE,
                  config,
                  lastRequest
                )
              );
            }
          });

          responseStream.on('aborted', function handlerStreamAborted() {
            if (rejected) {
              return;
            }

            const err = new AxiosError(
              'stream has been aborted',
              AxiosError.ERR_BAD_RESPONSE,
              config,
              lastRequest
            );
            responseStream.destroy(err);
            reject(err);
          });

          responseStream.on('error', function handleStreamError(err) {
            if (req.destroyed) return;
            reject(AxiosError.from(err, null, config, lastRequest));
          });

          responseStream.on('end', function handleStreamEnd() {
            try {
              let responseData =
                responseBuffer.length === 1 ? responseBuffer[0] : Buffer.concat(responseBuffer);
              if (responseType !== 'arraybuffer') {
                responseData = responseData.toString(responseEncoding);
                if (!responseEncoding || responseEncoding === 'utf8') {
                  responseData = utils.stripBOM(responseData);
                }
              }
              response.data = responseData;
            } catch (err) {
              return reject(AxiosError.from(err, null, config, response.request, response));
            }
            settle(resolve, reject, response);
          });
        }

        abortEmitter.once('abort', (err) => {
          if (!responseStream.destroyed) {
            responseStream.emit('error', err);
            responseStream.destroy();
          }
        });
      });

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 3 low-confidence finding(s)
low egress dependency Excluded from app score #b8883f62600e8a25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/lib/adapters/http.js:310 
    const req = session.request(http2Headers);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5956284d700c686d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/lib/adapters/http.js:708 
      req = transport.request(options, function handleResponse(res) {
        if (req.destroyed) return;

        const streams = [res];

        const responseLength = utils.toFiniteNumber(res.headers['content-length']);

        if (onDownloadProgress || maxDownloadRate) {
          const transformStream = new AxiosTransformStream({
            maxRate: utils.toFiniteNumber(maxDownloadRate),
          });

          onDownloadProgress &&
            transformStream.on(
              'progress',
              flushOnFinish(
                transformStream,
                progressEventDecorator(
                  responseLength,
                  progressEventReducer(asyncDecorator(onDownloadProgress), true, 3)
                )
              )
            );

          streams.push(transformStream);
        }

        // decompress the response body transparently if required
        let responseStream = res;

        // return the last request in case of redirects
        const lastRequest = res.req || req;

        // if decompress disabled we should not decompress
        if (config.decompress !== false && res.headers['content-encoding']) {
          // if no content, but headers still say that it is encoded,
          // remove the header not confuse downstream operations
          if (method === 'HEAD' || res.statusCode === 204) {
            delete res.headers['content-encoding'];
          }

          switch ((res.headers['content-encoding'] || '').toLowerCase()) {
            /*eslint default-case:0*/
            case 'gzip':
            case 'x-gzip':
            case 'compress':
            case 'x-compress':
              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'deflate':
              streams.push(new ZlibHeaderTransformStream());

              // add the unzipper to the body stream processing pipeline
              streams.push(zlib.createUnzip(zlibOptions));

              // remove the content-encoding in order to not confuse downstream operations
              delete res.headers['content-encoding'];
              break;
            case 'br':
              if (isBrotliSupported) {
                streams.push(zlib.createBrotliDecompress(brotliOptions));
                delete res.headers['content-encoding'];
              }
          }
        }

        responseStream = streams.length > 1 ? stream.pipeline(streams, utils.noop) : streams[0];

        const response = {
          status: res.statusCode,
          statusText: res.statusMessage,
          headers: new AxiosHeaders(res.headers),
          config,
          request: lastRequest,
        };

        if (responseType === 'stream') {
          response.data = responseStream;
          settle(resolve, reject, response);
        } else {
          const responseBuffer = [];
          let totalResponseBytes = 0;

          responseStream.on('data', function handleStreamData(chunk) {
            responseBuffer.push(chunk);
            totalResponseBytes += chunk.length;

            // make sure the content length is not over the maxContentLength if specified
            if (config.maxContentLength > -1 && totalResponseBytes > config.maxContentLength) {
              // stream.destroy() emit aborted event before calling reject() on Node.js v16
              rejected = true;
              responseStream.destroy();
              abort(
                new AxiosError(
                  'maxContentLength size of ' + config.maxContentLength + ' exceeded',
                  AxiosError.ERR_BAD_RESPONSE,
                  config,
                  lastRequest
                )
              );
            }
          });

          responseStream.on('aborted', function handlerStreamAborted() {
            if (rejected) {
              return;
            }

            const err = new AxiosError(
              'stream has been aborted',
              AxiosError.ERR_BAD_RESPONSE,
              config,
              lastRequest
            );
            responseStream.destroy(err);
            reject(err);
          });

          responseStream.on('error', function handleStreamError(err) {
            if (req.destroyed) return;
            reject(AxiosError.from(err, null, config, lastRequest));
          });

          responseStream.on('end', function handleStreamEnd() {
            try {
              let responseData =
                responseBuffer.length === 1 ? responseBuffer[0] : Buffer.concat(responseBuffer);
              if (responseType !== 'arraybuffer') {
                responseData = responseData.toString(responseEncoding);
                if (!responseEncoding || responseEncoding === 'utf8') {
                  responseData = utils.stripBOM(responseData);
                }
              }
              response.data = responseData;
            } catch (err) {
              return reject(AxiosError.from(err, null, config, response.request, response));
            }
            settle(resolve, reject, response);
          });
        }

        abortEmitter.once('abort', (err) => {
          if (!responseStream.destroyed) {
            responseStream.emit('error', err);
            responseStream.destroy();
          }
        });
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #3617836ddbbb1cbd — Environment-variable access.
pkgs/npm/[email protected]/lib/helpers/shouldBypassProxy.js:64 
  const noProxy = (process.env.no_proxy || process.env.NO_PROXY || '').toLowerCase();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

flowise-components

npm dependency
high pii_flow dependency Excluded from app score #1fe459ebe5ffeb51 — A credential read from the environment/filesystem flows to an external network call in a non-auth-header position (request body). Review what is sent.
pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:132 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:129 → /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:132 
        const response = await fetch(this.apiUrl, {
            method: 'POST',
            body: formData,
            headers
        })

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 353 low-confidence finding(s)
low egress dependency Excluded from app score #52b94d84305e3ce4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/evaluation/EvaluationRunner.ts:144 
                let response = await axios.post(`${this.baseURL}/api/v1/prediction/${chatflowId}`, postData, axiosConfig)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #24317fc3a9aabf69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/agentflow/utils.ts:534 
        const response = await fetch(`https://api.openai.com/v1/containers/${containerId}/files/${fileId}/content`, {
            method: 'GET',
            headers: {
                Accept: '*/*',
                Authorization: `Bearer ${openAIApiKey}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #acd5db251d8532c0 — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/ConversationalAgent/ConversationalAgent.ts:283 
        verbose: process.env.DEBUG === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c66b07315f851f14 — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/ConversationalRetrievalToolAgent/ConversationalRetrievalToolAgent.ts:360 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71ed5ee6941877d1 — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/LlamaIndexAgents/AnthropicAgent/AnthropicAgent_LlamaIndex.ts:104 
            verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8b6c0b0e88866fe — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/LlamaIndexAgents/AnthropicAgent/AnthropicAgent_LlamaIndex.ts:113 
        const response = await agent.chat({ message: input, chatHistory, verbose: process.env.DEBUG === 'true' ? true : false })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #14847e058b21e13a — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/LlamaIndexAgents/OpenAIToolAgent/OpenAIToolAgent_LlamaIndex.ts:115 
            verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc7a45e87259062b — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/LlamaIndexAgents/OpenAIToolAgent/OpenAIToolAgent_LlamaIndex.ts:130 
                verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #183ce0a137c7d8cb — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/LlamaIndexAgents/OpenAIToolAgent/OpenAIToolAgent_LlamaIndex.ts:157 
            const response = await agent.chat({ message: input, chatHistory, verbose: process.env.DEBUG === 'true' ? true : false })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #452811c2a571a4b0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/agents/OpenAIAssistant/OpenAIAssistant.ts:974 
        const response = await fetch(`https://api.openai.com/v1/files/${fileObj.id}/content`, {
            method: 'GET',
            headers: { Accept: '*/*', Authorization: `Bearer ${openAIApiKey}` }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #ed83c065eb850094 — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/ReActAgentChat/ReActAgentChat.ts:132 
            verbose: process.env.DEBUG === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f2c402118a2f797 — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/ReActAgentLLM/ReActAgentLLM.ts:105 
            verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f6dece4f5108c79 — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/ToolAgent/ToolAgent.ts:359 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b43b24d9dcb4f875 — Environment-variable access.
pkgs/npm/[email protected]/nodes/agents/XMLAgent/XMLAgent.ts:284 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9cec7b1eb64ac54d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisCache.ts:66 
            let value = await client.get(key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b3bbf83ce5c0082d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisCache.ts:74 
                value = await client.get(key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #a83b95cee6ce2874 — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisCache.ts:130 
                process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b92c5d7e49cb2369 — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisCache.ts:131 
                    ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d24012ba063a8cf — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisCache.ts:138 
                process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d8ace43604ee03f5 — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisCache.ts:139 
                    ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #846be61440ed5514 — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:87 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b4834fbdbee049bb — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:88 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #063726e165fab7ff — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:95 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bb9509a9a7cf68a — Environment-variable access.
pkgs/npm/[email protected]/nodes/cache/RedisCache/RedisEmbeddingsCache.ts:96 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95533fe2184a6437 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/ApiChain/GETApiChain.ts:134 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9e54541ba1ac78b — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/ApiChain/OpenAPIChain.ts:134 
        verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fc87166626f90f5b — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/ApiChain/POSTApiChain.ts:124 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0733952c51d837e9 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/ConversationChain/ConversationChain.ts:139 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8cfe5a56c7e9aea — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/ConversationalRetrievalQAChain/ConversationalRetrievalQAChain.ts:229 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d667a37e9fdde9ff — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/GraphCypherQAChain/GraphCypherQAChain.ts:423 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6d0c49730c95219 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/LLMChain/LLMChain.ts:109 
                verbose: process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19fc3a6ccb2f6f5e — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/LLMChain/LLMChain.ts:117 
                verbose: process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b17c7741eaa565e — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/MultiPromptChain/MultiPromptChain.ts:71 
            llmChainOpts: { verbose: process.env.DEBUG === 'true' ? true : false }

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #adb5a0cf0347bf60 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/MultiRetrievalQAChain/MultiRetrievalQAChain.ts:79 
            retrievalQAChainOpts: { verbose: process.env.DEBUG === 'true' ? true : false, returnSourceDocuments }

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #685db4a198c2322f — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/RetrievalQAChain/RetrievalQAChain.ts:58 
        const chain = RetrievalQAChain.fromLLM(model, vectorStoreRetriever, { verbose: process.env.DEBUG === 'true' ? true : false })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bb9534755ab1cb6 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/SqlDatabaseChain/SqlDatabaseChain.ts:245 
        verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #718912256737f213 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/chains/VectaraChain/VectaraChain.ts:312 
            const response = await fetch(`https://api.vectara.io/v1/query`, {
                method: 'POST',
                headers: headers?.headers,
                body: JSON.stringify(data)
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #a01bbc8de9f54a23 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chains/VectorDBQAChain/VectorDBQAChain.ts:60 
            verbose: process.env.DEBUG === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #54c889556dd81588 — Filesystem access.
pkgs/npm/[email protected]/nodes/chatmodels/AWSBedrock/AWSBedrockCatalog.test.ts:1 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4fd8510c16bdc8e8 — Filesystem access.
pkgs/npm/[email protected]/nodes/chatmodels/AWSBedrock/AWSBedrockCatalog.test.ts:9 
        const raw = JSON.parse(fs.readFileSync(modelsPath, 'utf8'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #00061f2b8c45a385 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:10 
    !!process.env.AZURE_OPENAI_API_KEY &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d8d83dafc544c32 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:11 
    !!process.env.AZURE_OPENAI_API_INSTANCE_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a0276f4d4075bb90 — Environment-variable access.
pkgs/npm/[email protected]/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:12 
    !!process.env.AZURE_OPENAI_API_DEPLOYMENT_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d018703b214534de — Environment-variable access.
pkgs/npm/[email protected]/nodes/chatmodels/AzureChatOpenAI/AzureChatOpenAI.ts:13 
    !!process.env.AZURE_OPENAI_API_VERSION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #1d2fc9d16da90479 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/chatmodels/ChatNemoGuardrails/NemoClient.ts:66 
        return await fetch(`${this.config.baseUrl}/v1/chat/completions`, requestOptions)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4edd55b8606ef985 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/Airtable/Airtable.ts:318 
            const response = await axios.post(url, data, { headers })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #694e3397355d6b90 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Cheerio/Cheerio.ts:153 
                    if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e755afe0fe65094 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Cheerio/Cheerio.ts:166 
                if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4550b533feb10967 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Cheerio/Cheerio.ts:175 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Start CheerioWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffe68244a21c355f — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Cheerio/Cheerio.ts:186 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bb3ac0e323bd1e8 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Cheerio/Cheerio.ts:192 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Finish CheerioWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #58218a5d39dca4e7 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Cheerio/Cheerio.ts:194 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70d6c5f380b1de56 — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/Epub/Epub.ts:7 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4e492a7a57c5d6a — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/Epub/Epub.ts:127 
                    fs.writeFileSync(tempFilePath, fileData)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba5f20111f37aac4 — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/Epub/Epub.ts:139 
                    fs.writeFileSync(tempFilePath, fileBuffer)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c534d4b8eeca9e5 — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:15 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #acb30555e682745c — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:227 
                const url = new URL('https://www.googleapis.com/drive/v3/files')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4433832487900a05 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:239 
                const response = await fetch(url.toString(), {
                    headers: {
                        Authorization: `Bearer ${accessToken}`,
                        'Content-Type': 'application/json'
                    }
                })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #505a555d4a5b247d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:412 
        const response = await fetch(url.toString(), {
            headers: {
                Authorization: `Bearer ${accessToken}`,
                'Content-Type': 'application/json'
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #91d38d0394715dc6 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:454 
            const url = new URL('https://www.googleapis.com/drive/v3/files')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #58c92f08bd56055e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:472 
            const response = await fetch(url.toString(), {
                headers: {
                    Authorization: `Bearer ${accessToken}`,
                    'Content-Type': 'application/json'
                }
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #880b85d2e7fb42d5 — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:702 
        fs.writeFileSync(tempFilePath, buffer)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #99e2d0574f04415d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:709 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5494d4a228da7a7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:726 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7bbffaf0279e0fd2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleDrive/GoogleDrive.ts:808 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #706621c15fb22c71 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:155 
                const url = new URL('https://www.googleapis.com/drive/v3/files')

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d65d2d8a794126f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:161 
                const response = await fetch(url.toString(), {
                    headers: {
                        Authorization: `Bearer ${accessToken}`,
                        'Content-Type': 'application/json'
                    }
                })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bfd5e0406709c2d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:316 
        const response = await fetch(url, {
            headers: {
                Authorization: `Bearer ${accessToken}`,
                'Content-Type': 'application/json'
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #05ea8251e346e0ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/GoogleSheets/GoogleSheets.ts:339 
        const response = await fetch(`${url}?${params}`, {
            headers: {
                Authorization: `Bearer ${accessToken}`,
                'Content-Type': 'application/json'
            }
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #fc475fcf93575ce6 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Playwright/Playwright.ts:194 
                const executablePath = process.env.PLAYWRIGHT_EXECUTABLE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d04f4d3cce8e7ad — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Playwright/Playwright.ts:235 
                if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42c67b20156d24be — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Playwright/Playwright.ts:242 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Start PlaywrightWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f6324c7f513140f9 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Playwright/Playwright.ts:253 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4afb771878b38be — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Playwright/Playwright.ts:262 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Finish PlaywrightWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec077dc5f171b327 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Playwright/Playwright.ts:264 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #37304743ae8dffa6 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Puppeteer/Puppeteer.ts:185 
                const executablePath = process.env.PUPPETEER_EXECUTABLE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8ef07a11058fc24 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Puppeteer/Puppeteer.ts:226 
                if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd42767a67722cb5 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Puppeteer/Puppeteer.ts:233 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Start PuppeteerWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #09b4a20f1b81f1d9 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Puppeteer/Puppeteer.ts:244 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e61abaf40b313a4 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Puppeteer/Puppeteer.ts:253 
            if (process.env.DEBUG === 'true') options.logger.info(`[${orgId}]: Finish PuppeteerWebBaseLoader ${relativeLinksMethod}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5f0039fa09384c1a — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Puppeteer/Puppeteer.ts:255 
            if (process.env.DEBUG === 'true')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da8ff1cfeeeeca0b — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/S3Directory/S3Directory.ts:217 
                        fsDefault.writeFileSync(filePath, objectData)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c4beb085dec7a762 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/S3File/S3File.ts:130 
                placeholder: process.env.UNSTRUCTURED_API_URL || 'http://localhost:8000/general/v0/general',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7495deda928ad4bc — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/S3File/S3File.ts:131 
                optional: !!process.env.UNSTRUCTURED_API_URL,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9e7519da769e22dd — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/S3File/S3File.ts:784 
                    fsDefault.writeFileSync(filePath, objectData)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bef494980b32b6e — Filesystem access.
pkgs/npm/[email protected]/nodes/documentloaders/S3File/S3File.ts:1020 
        fsDefault.writeFileSync(tempFilePath, buffer)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9ef40f2b9a7c772 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:30 
    private apiUrl = process.env.UNSTRUCTURED_API_URL || 'https://api.unstructuredapp.io/general/v0/general'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c5516331cbfcc2a3 — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:32 
    private apiKey: string | undefined = process.env.UNSTRUCTURED_API_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #5260fa0e1ecf27f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/Unstructured.ts:132 
        const response = await fetch(this.apiUrl, {
            method: 'POST',
            body: formData,
            headers
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #874f1ba6e158b4bd — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/UnstructuredFile.ts:57 
                placeholder: process.env.UNSTRUCTURED_API_URL || 'http://localhost:8000/general/v0/general',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfdcb50d387acf8f — Environment-variable access.
pkgs/npm/[email protected]/nodes/documentloaders/Unstructured/UnstructuredFile.ts:58 
                optional: !!process.env.UNSTRUCTURED_API_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e5c3e768d55a666d — Environment-variable access.
pkgs/npm/[email protected]/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:6 
    !!process.env.AZURE_OPENAI_API_KEY &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b9cf684d3ce5f68 — Environment-variable access.
pkgs/npm/[email protected]/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:7 
    !!process.env.AZURE_OPENAI_API_INSTANCE_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2dd6fe91d00fdbb8 — Environment-variable access.
pkgs/npm/[email protected]/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:8 
    (!!process.env.AZURE_OPENAI_API_EMBEDDINGS_DEPLOYMENT_NAME || !!process.env.AZURE_OPENAI_API_DEPLOYMENT_NAME) &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c09ab5e597c797e — Environment-variable access.
pkgs/npm/[email protected]/nodes/embeddings/AzureOpenAIEmbedding/AzureOpenAIEmbedding.ts:9 
    !!process.env.AZURE_OPENAI_API_VERSION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d425205993b3c2f — Environment-variable access.
pkgs/npm/[email protected]/nodes/llms/Azure OpenAI/AzureOpenAI.ts:9 
    !!process.env.AZURE_OPENAI_API_KEY &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e10a00a6b31c71dc — Environment-variable access.
pkgs/npm/[email protected]/nodes/llms/Azure OpenAI/AzureOpenAI.ts:10 
    !!process.env.AZURE_OPENAI_API_INSTANCE_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #141bdf3fc28d942c — Environment-variable access.
pkgs/npm/[email protected]/nodes/llms/Azure OpenAI/AzureOpenAI.ts:11 
    !!process.env.AZURE_OPENAI_API_DEPLOYMENT_NAME &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3b80efb5b2088dc8 — Environment-variable access.
pkgs/npm/[email protected]/nodes/llms/Azure OpenAI/AzureOpenAI.ts:12 
    !!process.env.AZURE_OPENAI_API_VERSION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd9906dff3c54224 — Environment-variable access.
pkgs/npm/[email protected]/nodes/memory/AgentMemory/AgentMemory.ts:138 
                : path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8690a09bd305fbdf — Environment-variable access.
pkgs/npm/[email protected]/nodes/memory/AgentMemory/SQLiteAgentMemory/SQLiteAgentMemory.ts:72 
        const database = validateSQLitePath(path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1681697481ab44d — Environment-variable access.
pkgs/npm/[email protected]/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:144 
                          process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eba8f53cb49c0017 — Environment-variable access.
pkgs/npm/[email protected]/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:145 
                              ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8fe4ef62ea9fb188 — Environment-variable access.
pkgs/npm/[email protected]/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:151 
                          process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7beb277cbf44ff86 — Environment-variable access.
pkgs/npm/[email protected]/nodes/memory/RedisBackedChatMemory/RedisBackedChatMemory.ts:152 
                              ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #55372060fb5bcf28 — Environment-variable access.
pkgs/npm/[email protected]/nodes/multiagents/Worker/Worker.ts:235 
            verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c01c6ac37806c56f — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts:10 
const serverCredentialsExists = !!process.env.POSTGRES_RECORDMANAGER_USER && !!process.env.POSTGRES_RECORDMANAGER_PASSWORD

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #35f955a7656e61b7 — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts:139 
        const user = getCredentialParam('user', credentialData, nodeData, process.env.POSTGRES_RECORDMANAGER_USER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e68d390068dd6554 — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/PostgresRecordManager.ts:140 
        const password = getCredentialParam('password', credentialData, nodeData, process.env.POSTGRES_RECORDMANAGER_PASSWORD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f217df2ffcd1a95 — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/utils.ts:4 
    return defaultChain(nodeData?.inputs?.host, process.env.POSTGRES_RECORDMANAGER_HOST)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68974078da5ce467 — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/utils.ts:8 
    return defaultChain(nodeData?.inputs?.database, process.env.POSTGRES_RECORDMANAGER_DATABASE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b97b76312a110b14 — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/utils.ts:12 
    return defaultChain(nodeData?.inputs?.port, process.env.POSTGRES_RECORDMANAGER_PORT, '5432')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27d14c63787d961a — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/utils.ts:16 
    return defaultChain(nodeData?.inputs?.ssl, process.env.POSTGRES_RECORDMANAGER_SSL, false)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a47a1194daf7f87 — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/PostgresRecordManager/utils.ts:20 
    return defaultChain(nodeData?.inputs?.tableName, process.env.POSTGRES_RECORDMANAGER_TABLE_NAME, 'upsertion_records')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7fd16a65f0c3acbc — Environment-variable access.
pkgs/npm/[email protected]/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts:124 
        const database = validateSQLitePath(path.join(process.env.DATABASE_PATH ?? path.join(getUserHome(), '.flowise'), 'database.sqlite'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #4b4b9b7b0414bb61 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/retrievers/CohereRerankRetriever/CohereRerank.ts:44 
            let returnedDocs = await axios.post(this.COHERE_API_URL, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6731c1430ffbdb58 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/retrievers/JinaRerankRetriever/JinaRerank.ts:39 
            let returnedDocs = await axios.post(this.JINA_RERANK_API_URL, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #01f9e8b053f3d1d4 — Environment-variable access.
pkgs/npm/[email protected]/nodes/retrievers/MultiQueryRetriever/MultiQueryRetriever.ts:75 
            verbose: process.env.DEBUG === 'true',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #bb18fa99626909b1 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/retrievers/VoyageAIRetriever/VoyageAIRerank.ts:40 
            let returnedDocs = await axios.post(this.VOYAGEAI_RERANK_API_URL, data, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #a1f5c5254236a99c — Environment-variable access.
pkgs/npm/[email protected]/nodes/sequentialagents/Agent/Agent.ts:690 
            verbose: process.env.DEBUG === 'true' ? true : false,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4e9ce8f0a9979aca — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/Arxiv/Arxiv.ts:119 
        if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #5cbf558023afad79 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/Arxiv/core.ts:157 
        const response = await fetch(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #a27c5b49f8f94253 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/Arxiv/core.ts:173 
        const response = await fetch(pdfUrl)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #ff85b5bbe8e5ee74 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/Gmail/core.ts:86 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #fabf5ae71188e233 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/GoogleCalendar/core.ts:160 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #49b191abc4161423 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/GoogleDocs/core.ts:118 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #9204b64561744ad6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/GoogleDocs/core.ts:153 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #eb8cfff215e505a9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/GoogleDrive/core.ts:150 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? (typeof body === 'string' ? body : JSON.stringify(body)) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #73dbfd056c321ec9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/GoogleDrive/core.ts:341 
        const response = await fetch(url, {
            method: 'POST',
            headers,
            body: params.content
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #33f9dc906e602350 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/GoogleDrive/core.ts:386 
            const response = await fetch(url, {
                method: 'POST',
                headers,
                body: body
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #6930c04fc7c3c996 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/GoogleSheets/core.ts:147 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #13cd43dad6be545e — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/CustomMCP/CustomMCP.ts:77 
                    process.env.CUSTOM_MCP_PROTOCOL === 'sse'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c7e31d92a688fde1 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/CustomMCP/CustomMCP.ts:176 
            if (process.env.CUSTOM_MCP_SECURITY_CHECK !== 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #eada623d9129bf89 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/CustomMCP/CustomMCP.ts:186 
            if (process.env.CUSTOM_MCP_PROTOCOL === 'stdio' && serverParams!.command) toolkit = new MCPToolkit(serverParams, 'stdio')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #e3e6cf2772dd2f8f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/MCP/Pipedream/PipedreamMCP.ts:51 
                const res = await client.request(req, CallToolResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #99d6ea4040e1733b — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/MCP/Pipedream/PipedreamMCP.ts:212 
            const response = await axios.post('https://api.pipedream.com/v1/oauth/token', body, {
                headers: {
                    'Content-Type': 'application/json'
                }
            })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #c116b05f435d981a — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/Supergateway/SupergatewayMCP.ts:109 
        if (process.env.CUSTOM_MCP_SECURITY_CHECK !== 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #75896ac75f01a95e — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:416 
        const originalAllowList = process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #dc3bac45aebc4417 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:420 
                delete process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #44286b24001578f4 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:422 
                process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = originalAllowList

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fb9c0b3ecb71e130 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:427 
            delete process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #bb5762d262906b24 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:435 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'API_KEY'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5ca73520f75a9803 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:447 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'CUSTOM_VAR'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a57049f5f3fb91be — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:455 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'CUSTOM_VAR,API_KEY'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a73bef220a2880b6 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:520 
            const original = process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #980a6fe875cf24e2 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:521 
            process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = 'API_TOKEN'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9d1c748e0391f7ef — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:533 
                    delete process.env.CUSTOM_MCP_ALLOWED_ENV_VARS

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #93aa065a302f2970 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.test.ts:535 
                    process.env.CUSTOM_MCP_ALLOWED_ENV_VARS = original

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8913f0cb50d8035f — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.ts:48 
                    PATH: process.env.PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #29cd7af68f08e3f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/MCP/core.ts:110 
            this._tools = await this.client.request({ method: 'tools/list' }, ListToolsResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #5f5df10f0f2f46c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/MCP/core.ts:164 
                const res = await client.request(req, CallToolResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #83d21944f5cd96e0 — Environment-variable access.
pkgs/npm/[email protected]/nodes/tools/MCP/core.ts:258 
        (process.env.CUSTOM_MCP_ALLOWED_ENV_VARS ?? '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #806761b74adfab76 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/MicrosoftOutlook/core.ts:150 
        const response = await fetch(url, {
            method,
            headers,
            body: body ? JSON.stringify(body) : undefined
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #7f625b8d09cc693b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/tools/MicrosoftTeams/core.ts:37 
        const response = await fetch(`${BASE_URL}${endpoint}`, config)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #29f77f2071d71c17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/nodes/vectorstores/Meilisearch/Meilisearch.ts:245 
            const response = await fetch(experimentalEndpoint, experimentalOptions)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #baf92de883f789a5 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Pinecone/Pinecone_LlamaIndex.ts:238 
        this.chunkSize = params?.chunkSize ?? Number.parseInt(process.env.PINECONE_CHUNK_SIZE ?? '100')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d9823c16b546ba1d — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/Postgres.ts:13 
const serverCredentialsExists = !!process.env.POSTGRES_VECTORSTORE_USER && !!process.env.POSTGRES_VECTORSTORE_PASSWORD

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6d6cef58c5fa299 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/driver/Base.ts:68 
        const user = getCredentialParam('user', credentialData, this.nodeData, process.env.POSTGRES_VECTORSTORE_USER)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0d4cfae0a42ebada — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/driver/Base.ts:69 
        const password = getCredentialParam('password', credentialData, this.nodeData, process.env.POSTGRES_VECTORSTORE_PASSWORD)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0dd72953450c2b3e — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/utils.ts:4 
    return defaultChain(nodeData?.inputs?.host, process.env.POSTGRES_VECTORSTORE_HOST)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #716fa43c9387e26e — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/utils.ts:8 
    return defaultChain(nodeData?.inputs?.database, process.env.POSTGRES_VECTORSTORE_DATABASE)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #38176fafe1418df6 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/utils.ts:12 
    return defaultChain(nodeData?.inputs?.port, process.env.POSTGRES_VECTORSTORE_PORT, '5432')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f47dee0d0bfc8b33 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/utils.ts:16 
    return defaultChain(nodeData?.inputs?.ssl, process.env.POSTGRES_VECTORSTORE_SSL, false)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b357433bf19b880 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/utils.ts:20 
    return defaultChain(nodeData?.inputs?.tableName, process.env.POSTGRES_VECTORSTORE_TABLE_NAME, 'documents')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0379687a4903015d — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/utils.ts:24 
    return defaultChain(nodeData?.inputs?.contentColumnName, process.env.POSTGRES_VECTORSTORE_CONTENT_COLUMN_NAME, 'pageContent')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a860f92f1822b7e9 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Postgres/utils.ts:28 
    return defaultChain(nodeData?.inputs?.schemaName, process.env.POSTGRES_VECTORSTORE_SCHEMA_NAME)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d32b5c8346f7ed0c — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:154 
                            process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c827eea32a40603a — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:155 
                                ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #932c2b9d859b37e1 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:159 
                        process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b910d6969cda377d — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:160 
                            ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #418ab255145678a8 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:172 
                    if (process.env.DEBUG === 'true') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78d1c0129b68e7e3 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:231 
                    process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcc57e2b4704b1cf — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:232 
                        ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2256286268d77720 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:236 
                process.env.REDIS_KEEP_ALIVE && !isNaN(parseInt(process.env.REDIS_KEEP_ALIVE, 10))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #836dfb43899b9817 — Environment-variable access.
pkgs/npm/[email protected]/nodes/vectorstores/Redis/Redis.ts:237 
                    ? parseInt(process.env.REDIS_KEEP_ALIVE, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6a624eab440c3c75 — Environment-variable access.
pkgs/npm/[email protected]/src/handler.test.ts:388 
        for (const k of LANGSMITH_KEYS) envSnapshot[k] = process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9e47e1f04c2fd131 — Environment-variable access.
pkgs/npm/[email protected]/src/handler.test.ts:389 
        for (const k of LANGSMITH_KEYS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8de3422aa72bdccd — Environment-variable access.
pkgs/npm/[email protected]/src/handler.test.ts:390 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #27c08cb0044d02f1 — Environment-variable access.
pkgs/npm/[email protected]/src/handler.test.ts:391 
        process.env.LANGSMITH_API_KEY = 'test-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6d1bfa384c1db041 — Environment-variable access.
pkgs/npm/[email protected]/src/handler.test.ts:397 
        for (const k of LANGSMITH_KEYS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #454969aa07419138 — Environment-variable access.
pkgs/npm/[email protected]/src/handler.test.ts:400 
            if (v !== undefined) process.env[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6b38ea1740e7b173 — Environment-variable access.
pkgs/npm/[email protected]/src/handler.ts:81 
        if (process.env.DEBUG === 'true') console.error(`Error setting up Arize tracer: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #02f38c36fac0e003 — Environment-variable access.
pkgs/npm/[email protected]/src/handler.ts:135 
        if (process.env.DEBUG === 'true') console.error(`Error setting up Phoenix tracer: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a8e9829796e400db — Environment-variable access.
pkgs/npm/[email protected]/src/handler.ts:179 
        if (process.env.DEBUG === 'true') console.error(`Error setting up Opik tracer: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1bcfa038be4f4ee7 — Environment-variable access.
pkgs/npm/[email protected]/src/httpSecurity.ts:36 
    const securityCheckEnabled = process.env.HTTP_SECURITY_CHECK !== 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0dd2452c8fa9d08c — Environment-variable access.
pkgs/npm/[email protected]/src/httpSecurity.ts:37 
    const httpDenyListString = process.env.HTTP_DENY_LIST

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #21a852b83330b67f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/httpSecurity.ts:249 
        const response = await fetch(currentUrl, { ...currentInit, agent: () => agent })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #4c0e404a84ee1ef0 — Filesystem access.
pkgs/npm/[email protected]/src/modelLoader.ts:2 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #00eab01a036e96ff — Environment-variable access.
pkgs/npm/[email protected]/src/modelLoader.ts:38 
        process.env.MODEL_LIST_CONFIG_JSON ?? 'https://raw.githubusercontent.com/FlowiseAI/Flowise/main/packages/components/models.json'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #ba0963ec32af8b42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/modelLoader.ts:41 
            const resp = await axios.get(modelFile)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #62b9d9bf15822e79 — Filesystem access.
pkgs/npm/[email protected]/src/modelLoader.ts:48 
            const models = await fs.promises.readFile(modelFile, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #466ab414347d951c — Filesystem access.
pkgs/npm/[email protected]/src/modelLoader.ts:55 
        const models = await fs.promises.readFile(getModelsJSONPath(), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #ad530b00137d98d9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/speechToText.ts:96 
                    const response = await axios.post(`${baseUrl}?api-version=${apiVersion}`, formData, {
                        headers: {
                            'Ocp-Apim-Subscription-Key': credentialData.azureSubscriptionKey,
                            Accept: 'application/json'
                        }
                    })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #30d033ff666e76f4 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:40 
        const connectionString = process.env.AZURE_BLOB_STORAGE_CONNECTION_STRING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb3268279d092b06 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:41 
        const accountName = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4e04af06d46463a — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:42 
        const accountKey = process.env.AZURE_BLOB_STORAGE_ACCOUNT_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #08f0c7fe6705bcc1 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:43 
        const containerName = process.env.AZURE_BLOB_STORAGE_CONTAINER_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1a0edac8110f8ef5 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:265 
        const connectionString = process.env.AZURE_BLOB_STORAGE_CONNECTION_STRING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #892871073c1d11ff — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:276 
            storageConfig.accountName = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d2ac1b2bee5499d6 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:277 
            storageConfig.accessKey = process.env.AZURE_BLOB_STORAGE_ACCOUNT_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #41a5652432de2bbe — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:285 
        const connectionString = process.env.AZURE_BLOB_STORAGE_CONNECTION_STRING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #13c56a12527c8f7a — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:286 
        const accountName = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #187cbf7ac54215d4 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/AzureBlobStorageProvider.ts:287 
        const accountKey = process.env.AZURE_BLOB_STORAGE_ACCOUNT_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #24c478e1bf3332a9 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/BaseStorageProvider.ts:63 
        const storagePath = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #568ee2379bf2fd3e — Environment-variable access.
pkgs/npm/[email protected]/src/storage/BaseStorageProvider.ts:64 
            ? path.join(process.env.BLOB_STORAGE_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39b7cd410ebbd40e — Environment-variable access.
pkgs/npm/[email protected]/src/storage/GCSStorageProvider.ts:32 
        const keyFilename = process.env.GOOGLE_CLOUD_STORAGE_CREDENTIAL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3601befc172b2ce1 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/GCSStorageProvider.ts:33 
        const projectId = process.env.GOOGLE_CLOUD_STORAGE_PROJ_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f2e9586f6e51504 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/GCSStorageProvider.ts:34 
        const bucketName = process.env.GOOGLE_CLOUD_STORAGE_BUCKET_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e21aa5467f5d115 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/GCSStorageProvider.ts:333 
                uniformBucketLevelAccess: Boolean(process.env.GOOGLE_CLOUD_UNIFORM_BUCKET_ACCESS) ?? true,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8e50f5bafabe023d — Filesystem access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:1 
import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ec189731c626d086 — Filesystem access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:40 
        fs.writeFileSync(filePath, bf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6e87accbafc8dbda — Filesystem access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:60 
        fs.writeFileSync(filePath, bf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bea4464a65e80000 — Filesystem access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:74 
        fs.writeFileSync(filePath, bf)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a60583aeb5eb900c — Filesystem access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:81 
        return fs.readFileSync(filePath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b70f9a559f88039a — Filesystem access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:88 
            return fs.readFileSync(fileInStorage)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15ba1abad7d88d4b — Filesystem access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:114 
                    return fs.readFileSync(targetPath)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8df9a1b306f03d9b — Environment-variable access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:344 
        return process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0f8769e1971735d — Environment-variable access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:345 
            ? path.join(process.env.BLOB_STORAGE_PATH, 'uploads')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfbf19c2765d1e84 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/LocalStorageProvider.ts:350 
        return process.env.HOME || process.env.USERPROFILE || process.env.HOMEPATH || ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee6cae8ef2833c55 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:34 
        const accessKeyId = process.env.S3_STORAGE_ACCESS_KEY_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90f7284147229b90 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:35 
        const secretAccessKey = process.env.S3_STORAGE_SECRET_ACCESS_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c8fea20ca16c8b0 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:36 
        const region = process.env.S3_STORAGE_REGION

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d27cce70147dd313 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:37 
        const bucket = process.env.S3_STORAGE_BUCKET_NAME

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07086fe9eb9e259c — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:38 
        const customURL = process.env.S3_ENDPOINT_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3bc1a71ef56fe87 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:39 
        const forcePathStyle = process.env.S3_FORCE_PATH_STYLE === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #78db26e4b2a70456 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:73 
            region: process.env.S3_STORAGE_REGION,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d333948b9e0514a — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:74 
            endpoint: process.env.S3_ENDPOINT_URL

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5c70ec87f3dcaa11 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/S3StorageProvider.ts:536 
            const instance = process.env.HOSTNAME || process.env.POD_NAME || String(process.pid)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #def0c51ca2a59136 — Environment-variable access.
pkgs/npm/[email protected]/src/storage/StorageProviderFactory.ts:20 
            const storageType = process.env.STORAGE_TYPE || 'local'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #43969e34fb7498d1 — Filesystem access.
pkgs/npm/[email protected]/src/storageUtils.ts:1 
import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #479570288eca9f22 — Environment-variable access.
pkgs/npm/[email protected]/src/storageUtils.ts:51 
    const storagePath = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d650b0a329d8d4c2 — Environment-variable access.
pkgs/npm/[email protected]/src/storageUtils.ts:52 
        ? path.join(process.env.BLOB_STORAGE_PATH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd99a5c791849f46 — Environment-variable access.
pkgs/npm/[email protected]/src/storageUtils.ts:64 
    return process.env.STORAGE_TYPE ? process.env.STORAGE_TYPE : 'local'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1015daa2a847bf17 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:21 
    for (const k of ENV_KEYS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6e37acb003ddff26 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:28 
    for (const k of ENV_KEYS) envSnapshot[k] = process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a5590744c76e1c71 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:37 
        if (v !== undefined) process.env[k] = v

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b35f9631011e6935 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:48 
        process.env.LANGSMITH_TRACING = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #50ab265c68ebdead — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:49 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8dd5c48f17412859 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:52 
        process.env.LANGSMITH_TRACING = '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1e7df0122e45939f — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:55 
        process.env.LANGSMITH_TRACING = 'TRUE'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c2fd1e61dec39c05 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:60 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #68df1112b0820f15 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:65 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #45a16d94d0b9777d — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:66 
        process.env.LANGSMITH_API_KEY = 'new-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7d18287847b74be8 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:75 
        process.env.LANGCHAIN_TRACING_V2 = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #17124808c6d811c1 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:76 
        process.env.LANGCHAIN_API_KEY = 'legacy-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7780d2ffa4527fb8 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:77 
        process.env.LANGCHAIN_ENDPOINT = 'https://legacy.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a544a9f53b6b1228 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:78 
        process.env.LANGCHAIN_PROJECT = 'legacy-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #92541bbd6ee6c860 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:87 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c985c2a46331c1dc — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:88 
        process.env.LANGCHAIN_TRACING_V2 = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2b1bfb50a7ba2840 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:89 
        process.env.LANGSMITH_API_KEY = 'new-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f07171416083e2f8 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:90 
        process.env.LANGCHAIN_API_KEY = 'legacy-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2fef552cf7ff244e — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:91 
        process.env.LANGSMITH_ENDPOINT = 'https://new.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ada39bf3c6cbc881 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:92 
        process.env.LANGCHAIN_ENDPOINT = 'https://legacy.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b67032fb40eece59 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:93 
        process.env.LANGSMITH_PROJECT = 'new-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5280e11d3152918f — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:94 
        process.env.LANGCHAIN_PROJECT = 'legacy-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #14742839fa9db9de — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:103 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1b237c74e6418af2 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:104 
        process.env.LANGCHAIN_API_KEY = 'legacy-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #94246ceac5094475 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:113 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #36bf8bef6c9bea2a — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:114 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #86cce5b531f0901a — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:115 
        process.env.LANGSMITH_ENDPOINT = 'https://api.smith.langchain.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f8d1dc72e1e776e4 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:116 
        process.env.LANGSMITH_PROJECT = 'my-proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c1e8fe892e87d7c5 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:129 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3ccae44697402621 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:130 
        process.env.LANGSMITH_API_KEY = 'k1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7a27dba490461dba — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:135 
        process.env.LANGSMITH_API_KEY = 'k2'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6d80c0681424253d — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:144 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3e01a0f47e4fd4cd — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:145 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2c500c2b9ea62766 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:152 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #98dde12f47689590 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:153 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f956f5262eefbabe — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:197 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cadc24ce78ed8bf7 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:198 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #09f1ead3f0fb3a0c — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:212 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #02d733bc2b8955a7 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:213 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cee3fb26b7d1181e — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:214 
        process.env.LANGSMITH_ENDPOINT = 'https://e.example.com'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #68c9f03f030b114a — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:215 
        process.env.LANGSMITH_PROJECT = 'proj'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6990c85009436340 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:233 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d141de8fc016c247 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:234 
        process.env.LANGSMITH_API_KEY = 'env-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #50f45e44a87a54d3 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:245 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #16209f3a6d1e244d — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:246 
        process.env.LANGSMITH_API_KEY = 'env-key'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c8be56b6c40636d1 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:259 
        process.env.LANGSMITH_TRACING = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f6465db4d4a9475f — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.test.ts:260 
        process.env.LANGSMITH_API_KEY = 'k'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d2add5865600703 — Environment-variable access.
pkgs/npm/[email protected]/src/tracingEnv.ts:71 
    for (const k of LANGCHAIN_TRACING_FLAG_VARS) delete process.env[k]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b5970162dd2af65b — Environment-variable access.
pkgs/npm/[email protected]/src/utils.test.ts:245 
        delete process.env.ALLOW_BUILTIN_DEP

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8adfe3671c7bff5f — Environment-variable access.
pkgs/npm/[email protected]/src/utils.test.ts:246 
        delete process.env.TOOL_FUNCTION_EXTERNAL_DEP

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1964411382703596 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.test.ts:251 
            process.env.ALLOW_BUILTIN_DEP = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #feb42df05c811ef1 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.test.ts:278 
        process.env.ALLOW_BUILTIN_DEP = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b5faa7349afcc6a4 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.test.ts:284 
        process.env.ALLOW_BUILTIN_DEP = 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7f720258bcba34d4 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.test.ts:285 
        process.env.TOOL_FUNCTION_EXTERNAL_DEP = 'pg'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fd0a5f6c04847b0c — Filesystem access.
pkgs/npm/[email protected]/src/utils.ts:12 
import * as fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5174b8b4e89be956 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:32 
const USE_AWS_SECRETS_MANAGER = process.env.SECRETKEY_STORAGE_TYPE === 'aws'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #201d209270b3ddb2 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:34 
    const region = process.env.SECRETKEY_AWS_REGION || 'us-east-1' // Default region if not provided

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e987d8a235654d8 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:35 
    const accessKeyId = process.env.SECRETKEY_AWS_ACCESS_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf2e4df6211f4e80 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:36 
    const secretAccessKey = process.env.SECRETKEY_AWS_SECRET_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #cdcc899b9e63aa65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/utils.ts:361 
        const response = await axios.get(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #bda576cc35571361 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:408 
            if (process.env.DEBUG === 'true') console.error(`error with scraped URL: ${err.message}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fe88c65c035994ce — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:454 
    if (process.env.DEBUG === 'true') console.info(`actively crawling ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48a44d7ca066f3df — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:459 
            if (process.env.DEBUG === 'true') console.error(`error in fetch with status code: ${resp.status}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d3ab14b42bde918f — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:465 
            if (process.env.DEBUG === 'true') console.error(`non html response, content type: ${contentType}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #32983ea9078401a6 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:475 
        if (process.env.DEBUG === 'true') console.error(`error in fetch url: ${err.message}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da7150e6da07f603 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:510 
    if (process.env.DEBUG === 'true') console.info(`actively scarping ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #579f62cd36f50df7 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:515 
            if (process.env.DEBUG === 'true') console.error(`error in fetch with status code: ${resp.status}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #233ac8834e9265b8 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:521 
            if (process.env.DEBUG === 'true') console.error(`non xml response, content type: ${contentType}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bcaf8e25aecfddd4 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:528 
        if (process.env.DEBUG === 'true') console.error(`error in fetch url: ${err.message}, on page: ${currentURL}`)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad049766b2dc469e — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:540 
        return typeof process !== 'undefined' ? process.env?.[name] : undefined

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #899f32f5ba3db9c8 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:571 
    return process.env.SECRETKEY_PATH ? path.join(process.env.SECRETKEY_PATH, 'encryption.key') : getEncryptionKeyFilePath()

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61187c2ee2c9c17c — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:579 
    if (process.env.FLOWISE_SECRETKEY_OVERWRITE !== undefined && process.env.FLOWISE_SECRETKEY_OVERWRITE !== '') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a010347f0dbe3866 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:580 
        return process.env.FLOWISE_SECRETKEY_OVERWRITE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd37de9c3e9c71ab — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:584 
            const secretId = process.env.SECRETKEY_AWS_NAME || 'FlowiseEncryptionKey'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #33c74e8fa6a94bff — Filesystem access.
pkgs/npm/[email protected]/src/utils.ts:592 
        return await fs.promises.readFile(getEncryptionKeyPath(), 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8c9c4a52a5dc4823 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:734 
    if (process.env[variableName] === undefined) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a4e3dc0a1a47364c — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:738 
    return process.env[variableName] as string

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9011f643ccba61a0 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1021 
                value = process.env[item.name] ?? ''

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4536fe4c89f9ea51 — Filesystem access.
pkgs/npm/[email protected]/src/utils.ts:1048 
            const content = await fs.promises.readFile(checkPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #05d2b2d5842d8d09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/utils.ts:1472 
                const refreshResponse = await fetch(
                    `${options.baseURL || 'http://localhost:3000'}/api/v1/oauth2-credential/refresh/${credentialId}`,
                    {
                        method: 'POST',
                        headers: {
                            'Content-Type': 'application/json'
                        }
                    }
                )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #2809181f831bbe1f — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1603 
    const shouldUseE2BSandbox = useSandbox && process.env.E2B_APIKEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #06732195742ca8a3 — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1606 
    if (process.env.SANDBOX_TIMEOUT) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b693d3e587992ada — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1607 
        timeoutMs = parseInt(process.env.SANDBOX_TIMEOUT, 10)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4d4397935f9df6cf — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1665 
            const sbx = await Sandbox.create({ apiKey: process.env.E2B_APIKEY, timeoutMs })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae71da75e4a378bf — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1729 
        const builtinDeps = process.env.TOOL_FUNCTION_BUILTIN_DEP

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a4383251ee4a2cd — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1730 
            ? defaultAllowBuiltInDep.concat(process.env.TOOL_FUNCTION_BUILTIN_DEP.split(','))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e21e877c294b96f — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1732 
        const externalDeps = process.env.TOOL_FUNCTION_EXTERNAL_DEP ? process.env.TOOL_FUNCTION_EXTERNAL_DEP.split(',') : []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49d1b7fbced673bd — Environment-variable access.
pkgs/npm/[email protected]/src/utils.ts:1733 
        let deps = process.env.ALLOW_BUILTIN_DEP === 'true' ? availableDependencies.concat(externalDeps) : externalDeps

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e675374491aa7ecb — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:55 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e788bdbc0031cb3f — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:58 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f2daf5a27cc7be2c — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:75 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0ca01ecc58873b8a — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:78 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #56ce2fef1d95e549 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:365 
            const originalEnv = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cc2bf93d20fb44c8 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:366 
            delete process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6832dcf7034c0dc2 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:375 
                    process.env.BLOB_STORAGE_PATH = originalEnv

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fe6424453cbfd8cc — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:396 
        const originalEnv = process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #43fc860de596f115 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:401 
                process.env.BLOB_STORAGE_PATH = originalEnv

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ea6661edc1cfc724 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:403 
                delete process.env.BLOB_STORAGE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #74f95fc87ae23b1d — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:409 
            process.env.BLOB_STORAGE_PATH = customStoragePath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #29c90c478c6be9ae — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:418 
            process.env.BLOB_STORAGE_PATH = path.join(userHome, 'custom-storage')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #74828b2deb9a237f — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:453 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #42adf1356f3bb11b — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:456 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8013ac4b73003684 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:591 
        const originalDatabasePath = process.env.DATABASE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1be7428e0f81c90f — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:595 
                delete process.env.DATABASE_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1b4fa37ce3cd2510 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:597 
                process.env.DATABASE_PATH = originalDatabasePath

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c4d387acc556a37e — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:603 
            process.env.DATABASE_PATH = customBase

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c66a1cbc82266acb — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:609 
            process.env.DATABASE_PATH = path.join(userHome, 'custom-flowise-data')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #aabde157be8e7110 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:616 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a46dbe69bc3cb6c5 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:619 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #42a5d7a7d8099af4 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:788 
            process.env.PATH_TRAVERSAL_SAFETY = 'false'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ea3e0de4e71bf365 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.test.ts:791 
            delete process.env.PATH_TRAVERSAL_SAFETY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2243d5d8ce146ef4 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:41 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8edd77955d30ec8e — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:70 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #161cd4fb071bfd53 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:195 
    if (process.env.BLOB_STORAGE_PATH) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #16d206c5bbaff527 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:196 
        allowedDirs.push(path.resolve(process.env.BLOB_STORAGE_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8b83fa0e4f31b2d0 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:213 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #15c0c951451430ae — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:290 
    if (process.env.DATABASE_PATH) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c367a557fa5747e — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:291 
        dirs.push(path.resolve(process.env.DATABASE_PATH))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c371bb577a926fe7 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:324 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1413165ee1e77b63 — Environment-variable access.
pkgs/npm/[email protected]/src/validator.ts:423 
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@anthropic-ai/sdk

npm dependency
medium pii_flow dependency Excluded from app score #b7896eca57f2d42b — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:42 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:39 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:42 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': `${types_1.OAUTH_API_BETA_HEADER},${types_1.FEDERATION_BETA_HEADER}`,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${version_1.VERSION} oidcFederationProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #0122d384e1cfd154 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:39 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:36 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:39 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #02e71ea0f6d1450d — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:94 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:91 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:94 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': types_1.OAUTH_API_BETA_HEADER,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${version_1.VERSION} userOAuthProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #b9bef19b95ba4d5c — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:58 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:55 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:58 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': OAUTH_API_BETA_HEADER,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} userOAuthProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #d48d0059ae0fadd9 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:83 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:80 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:83 
      resp = await config.fetch(url, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
          'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
        },
        body: JSON.stringify(body),
      });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #07edfa023c49f734 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:95 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:92 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:95 
      resp = await config.fetch(url, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'anthropic-beta': OAUTH_API_BETA_HEADER,
          'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} userOAuthProvider`,
        },
        body: JSON.stringify(body),
      });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 266 low-confidence finding(s)
low env_fs dependency Excluded from app score #ea534d52bee678ce — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.js:110 
        configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dcd339e40a3d374e — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.js:210 
        raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2115ce4fed2a798 — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.js:308 
        return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3281b934a87c2e5e — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.mjs:73 
        configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7472ebf38a49b29 — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.mjs:172 
        raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c19ceddb66660b66 — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.mjs:268 
        return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c313eba6156b3a2 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/credential-chain.js:203 
            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b5f409995c7f941b — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/credential-chain.mjs:166 
            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42f3fc8255ef8531 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/identity-token.js:51 
            content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a6cc58a653dec887 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/identity-token.mjs:14 
            content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5eac403c8061a77c — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/types.js:195 
            await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0c4fbf5b8af1ba67 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/types.mjs:154 
            await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3177236e86ef1dcc — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:56 
            raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88d4f4dd1a875a00 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:20 
            raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #2466ac7f87113fdd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:53 
        return this._client.get((0, path_1.path) `/v1/agents/${agentID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #17248de2e0df6990 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:76 
        return this._client.post((0, path_1.path) `/v1/agents/${agentID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9aec202ba3b09c4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:120 
        return this._client.post((0, path_1.path) `/v1/agents/${agentID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #59144e2ca8d57321 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:49 
        return this._client.get(path `/v1/agents/${agentID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42c67d161758f3b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:72 
        return this._client.post(path `/v1/agents/${agentID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aea0e55babd6578a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:116 
        return this._client.post(path `/v1/agents/${agentID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b86ca409039ad39b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployment-runs.js:23 
        return this._client.get((0, path_1.path) `/v1/deployment_runs/${deploymentRunID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #40c16d45b1472ec8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployment-runs.mjs:20 
        return this._client.get(path `/v1/deployment_runs/${deploymentRunID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a20d7f6391b3d0e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:58 
        return this._client.get((0, path_1.path) `/v1/deployments/${deploymentID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb15119b9c0beb44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:79 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b7f54ce2750ea9d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:123 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a07a5e2444967876 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:144 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/pause?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #55a0793ef5cb69fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:165 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/run?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc73b3e4dfb3d047 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:186 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/unpause?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #01adbc955bebddae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:55 
        return this._client.get(path `/v1/deployments/${deploymentID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #376316b4c579f57e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:76 
        return this._client.post(path `/v1/deployments/${deploymentID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #53c209095362235c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:120 
        return this._client.post(path `/v1/deployments/${deploymentID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #38978dc43376edea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:141 
        return this._client.post(path `/v1/deployments/${deploymentID}/pause?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #63f47103dcafe5b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:162 
        return this._client.post(path `/v1/deployments/${deploymentID}/run?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #077ab5606234c183 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:183 
        return this._client.post(path `/v1/deployments/${deploymentID}/unpause?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f2366c0b53487287 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.js:44 
        return this._client.get((0, path_1.path) `/v1/dreams/${dreamID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e7ab88ea9461b988 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.js:86 
        return this._client.post((0, path_1.path) `/v1/dreams/${dreamID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #418f2ee2a856a539 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.js:106 
        return this._client.post((0, path_1.path) `/v1/dreams/${dreamID}/cancel?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #53f15d50bd14b052 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:41 
        return this._client.get(path `/v1/dreams/${dreamID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fe8659c717b99cb5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:83 
        return this._client.post(path `/v1/dreams/${dreamID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #020a8b198cb4838c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:103 
        return this._client.post(path `/v1/dreams/${dreamID}/cancel?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f57cce0ffb03634 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:52 
        return this._client.get((0, path_1.path) `/v1/environments/${environmentID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1ced0d63060bd95a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:73 
        return this._client.post((0, path_1.path) `/v1/environments/${environmentID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c040e4fd06efaa11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:139 
        return this._client.post((0, path_1.path) `/v1/environments/${environmentID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #44c4108844730687 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:48 
        return this._client.get(path `/v1/environments/${environmentID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #78aae02fbdcc7f8e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:69 
        return this._client.post(path `/v1/environments/${environmentID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #988fc63b2c1e81e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:135 
        return this._client.post(path `/v1/environments/${environmentID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b2f9fe72a07ebff8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:30 
        return this._client.get((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98ba7d260c58eb0f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:57 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aa63dfabfbbf31d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:114 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}/ack?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e66b3ebde6231e5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:140 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}/heartbeat?beta=true`, {
            query: { desired_ttl_seconds, expected_last_heartbeat },
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #161d8169755b4857 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:167 
        return this._client.get((0, path_1.path) `/v1/environments/${environmentID}/work/poll?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString(),
                    ...(anthropicWorkerID != null ? { 'Anthropic-Worker-ID': anthropicWorkerID } : undefined),
                },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fe9ea2403d22e944 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:192 
        return this._client.get((0, path_1.path) `/v1/environments/${environmentID}/work/stats?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5b7bdb7dda0f4fbc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:218 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}/stop?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a6475365bf65821e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:27 
        return this._client.get(path `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ff0508267d3e98e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:54 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #19a010bfd0f77ad1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:111 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}/ack?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a85eb81ba4ac471 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:137 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}/heartbeat?beta=true`, {
            query: { desired_ttl_seconds, expected_last_heartbeat },
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a84ef4eeb65a9e97 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:164 
        return this._client.get(path `/v1/environments/${environmentID}/work/poll?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString(),
                    ...(anthropicWorkerID != null ? { 'Anthropic-Worker-ID': anthropicWorkerID } : undefined),
                },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e1ce0a937f686c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:189 
        return this._client.get(path `/v1/environments/${environmentID}/work/stats?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c713279435d2c673 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:215 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}/stop?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #52c614a4dc04f87f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.js:69 
        return this._client.get((0, path_1.path) `/v1/files/${fileID}/content?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b9e2ba4f0d185831 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.js:92 
        return this._client.get((0, path_1.path) `/v1/files/${fileID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #072defe692045d47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.mjs:66 
        return this._client.get(path `/v1/files/${fileID}/content?beta=true`, {
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #922a244378f3d76e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.mjs:89 
        return this._client.get(path `/v1/files/${fileID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #015c9f360fb7b657 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:24 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memoryStoreID}/memories?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #40811eab9ca9fb47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:48 
        return this._client.get((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #05a2ac7032bbd716 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:71 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bcdd32dfb8195261 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:21 
        return this._client.post(path `/v1/memory_stores/${memoryStoreID}/memories?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #143086649c581d44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:45 
        return this._client.get(path `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79446e7245c92d5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:68 
        return this._client.post(path `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79d7c94d58379885 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:53 
        return this._client.get((0, path_1.path) `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be3eeb1f2dbda843 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:72 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1998b27a4e1de24d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:133 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memoryStoreID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1b8069b20a7d1753 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:49 
        return this._client.get(path `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #83499ceb5f0d7abc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:68 
        return this._client.post(path `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #db932dcec2b4ce7f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:129 
        return this._client.post(path `/v1/memory_stores/${memoryStoreID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #68c7009811adaa40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.js:24 
        return this._client.get((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #269bc5bf1618fcd0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.js:71 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}/redact?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #12aa20a84d888fd6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.mjs:21 
        return this._client.get(path `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02370446be9b7b13 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.mjs:68 
        return this._client.post(path `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}/redact?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #315f785978636d60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:73 
        return this._client.get((0, path_1.path) `/v1/messages/batches/${messageBatchID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa93921d5864d5f1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:158 
        return this._client.post((0, path_1.path) `/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ae5da12d6ad07701 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:190 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #32264b75e9ffecf0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:70 
        return this._client.get(path `/v1/messages/batches/${messageBatchID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c37ef96eef7309c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:155 
        return this._client.post(path `/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6fa81d166f37dbad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:187 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3c30493b8a21e35f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/models.js:25 
        return this._client.get((0, path_1.path) `/v1/models/${modelID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cb1cb7d4e4319632 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/models.mjs:22 
        return this._client.get(path `/v1/models/${modelID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #382329d488059ce1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.js:61 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}/events?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #41e48e1edfcab91f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.js:83 
        return this._client.get((0, path_1.path) `/v1/sessions/${sessionID}/events/stream?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4d7ce47d76eea491 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.mjs:58 
        return this._client.post(path `/v1/sessions/${sessionID}/events?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2b0fa5529e870174 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.mjs:80 
        return this._client.get(path `/v1/sessions/${sessionID}/events/stream?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4d54a87be059dea8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:24 
        return this._client.get((0, path_1.path) `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #61e313abc4ebf9c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:49 
        return this._client.post((0, path_1.path) `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #956ce07745fbc25e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:121 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}/resources?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca5f8ff51ce0c1f3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:21 
        return this._client.get(path `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #46148c45d2191123 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:46 
        return this._client.post(path `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b255fe97023cb033 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:118 
        return this._client.post(path `/v1/sessions/${sessionID}/resources?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #20966720042587b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:59 
        return this._client.get((0, path_1.path) `/v1/sessions/${sessionID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ba52043db085e568 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:80 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5f2729270e4b946b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:145 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c338bfdfdee7e8c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:55 
        return this._client.get(path `/v1/sessions/${sessionID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #55b9b7534eeae29c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:76 
        return this._client.post(path `/v1/sessions/${sessionID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de0f08409a07ebd8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:141 
        return this._client.post(path `/v1/sessions/${sessionID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7fbacce815be159c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/events.js:49 
        return this._client.get((0, path_1.path) `/v1/sessions/${session_id}/threads/${threadID}/stream?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64bd1fbf6898b37f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/events.mjs:46 
        return this._client.get(path `/v1/sessions/${session_id}/threads/${threadID}/stream?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1c10923294a747fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.js:31 
        return this._client.get((0, path_1.path) `/v1/sessions/${session_id}/threads/${threadID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df0e9ff547000867 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.js:77 
        return this._client.post((0, path_1.path) `/v1/sessions/${session_id}/threads/${threadID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7d7847f47a6dbdac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.mjs:27 
        return this._client.get(path `/v1/sessions/${session_id}/threads/${threadID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5e9c67cd1c19413b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.mjs:73 
        return this._client.post(path `/v1/sessions/${session_id}/threads/${threadID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #14def0b7593a29d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/skills.js:49 
        return this._client.get((0, path_1.path) `/v1/skills/${skillID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #699e91cb296d1d99 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/skills.mjs:45 
        return this._client.get(path `/v1/skills/${skillID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2d924cb9f31fd1de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:24 
        return this._client.post((0, path_1.path) `/v1/skills/${skillID}/versions?beta=true`, (0, uploads_1.multipartFormRequestOptions)({
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        }, this._client, false));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b674f5e94c7773ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:46 
        return this._client.get((0, path_1.path) `/v1/skills/${skill_id}/versions/${version}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7465b0210553fbaf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:115 
        return this._client.get((0, path_1.path) `/v1/skills/${skill_id}/versions/${version}/content?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9224940d8a53c291 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:21 
        return this._client.post(path `/v1/skills/${skillID}/versions?beta=true`, multipartFormRequestOptions({
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        }, this._client, false));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7db5904e64fac96f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:43 
        return this._client.get(path `/v1/skills/${skill_id}/versions/${version}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #419be7f8e23a32b2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:112 
        return this._client.get(path `/v1/skills/${skill_id}/versions/${version}/content?beta=true`, {
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #293648a2be317bed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:31 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/certificates?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5f63bfe876b35f72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:59 
        return this._client.get((0, path_1.path) `/v1/tunnels/${tunnel_id}/certificates/${certificateID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2d034baac0871467 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:119 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnel_id}/certificates/${certificateID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #70776a39d2898585 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:28 
        return this._client.post(path `/v1/tunnels/${tunnelID}/certificates?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9c08b50fe98dfeae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:56 
        return this._client.get(path `/v1/tunnels/${tunnel_id}/certificates/${certificateID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9bf3d8c1afc5b8f1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:116 
        return this._client.post(path `/v1/tunnels/${tunnel_id}/certificates/${certificateID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d38fefb1cb9af24e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:60 
        return this._client.get((0, path_1.path) `/v1/tunnels/${tunnelID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0389b3d833da6dbc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:116 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #81ea6b75c1dcbd04 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:143 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/reveal_token?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e3463e0de4852055 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:169 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/rotate_token?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d17a72aae910ee5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:56 
        return this._client.get(path `/v1/tunnels/${tunnelID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5f6185561beffd1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:112 
        return this._client.post(path `/v1/tunnels/${tunnelID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c26a588e6decaa16 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:139 
        return this._client.post(path `/v1/tunnels/${tunnelID}/reveal_token?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5d6d48fc59a181de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:165 
        return this._client.post(path `/v1/tunnels/${tunnelID}/rotate_token?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b166d5ff39ea30a9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:43 
        return this._client.get((0, path_1.path) `/v1/user_profiles/${userProfileID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a20093ac3d0f134 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:64 
        return this._client.post((0, path_1.path) `/v1/user_profiles/${userProfileID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d2866c59016e6d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:108 
        return this._client.post((0, path_1.path) `/v1/user_profiles/${userProfileID}/enrollment_url?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9e46ef46592d4c1c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:40 
        return this._client.get(path `/v1/user_profiles/${userProfileID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #00a942a1007ba50d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:61 
        return this._client.post(path `/v1/user_profiles/${userProfileID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df1a98d9d4edcaf4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:105 
        return this._client.post(path `/v1/user_profiles/${userProfileID}/enrollment_url?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fd1fb74abe967776 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:31 
        return this._client.post((0, path_1.path) `/v1/vaults/${vaultID}/credentials?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #04f37b0bfc790624 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:54 
        return this._client.get((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #80d3dfd68eb11b83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:76 
        return this._client.post((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f7770e635f1ed20f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:145 
        return this._client.post((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3b86884658443ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:167 
        return this._client.post((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}/mcp_oauth_validate?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #931409e240fdf5cc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:28 
        return this._client.post(path `/v1/vaults/${vaultID}/credentials?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #349ef0bda8f0c590 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:51 
        return this._client.get(path `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a8214a6c3594ccdd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:73 
        return this._client.post(path `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a4d585ae8f28efaa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:142 
        return this._client.post(path `/v1/vaults/${vault_id}/credentials/${credentialID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bf3363707c022815 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:164 
        return this._client.post(path `/v1/vaults/${vault_id}/credentials/${credentialID}/mcp_oauth_validate?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #08f0d5a31b5f5a7e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:52 
        return this._client.get((0, path_1.path) `/v1/vaults/${vaultID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0bbeea5ec135a2d9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:73 
        return this._client.post((0, path_1.path) `/v1/vaults/${vaultID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #361802197f841e1d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:138 
        return this._client.post((0, path_1.path) `/v1/vaults/${vaultID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #62a2deb517223f81 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:48 
        return this._client.get(path `/v1/vaults/${vaultID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2d14b6f62d97f93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:69 
        return this._client.post(path `/v1/vaults/${vaultID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1947f85e7d61cf2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:134 
        return this._client.post(path `/v1/vaults/${vaultID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0dc020fd4081b1dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.js:67 
        return this._client.get((0, path_1.path) `/v1/messages/batches/${messageBatchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #10c39e7f1060f3dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.js:127 
        return this._client.post((0, path_1.path) `/v1/messages/batches/${messageBatchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d2d6d561d8e9947 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.js:150 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #52d8d52c66cc2219 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.mjs:64 
        return this._client.get(path `/v1/messages/batches/${messageBatchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #68f443d104e7cc10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.mjs:124 
        return this._client.post(path `/v1/messages/batches/${messageBatchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #905e2999d9589bae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.mjs:147 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a0137b6a3215e4e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/models.js:18 
        return this._client.get((0, path_1.path) `/v1/models/${modelID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #956507712358e5b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/models.mjs:15 
        return this._client.get(path `/v1/models/${modelID}`, {
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #ea65b3b9b4ac40ca — Filesystem access.
pkgs/npm/@[email protected]/src/core/credentials.ts:154 
    configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1aaf4e2b1bb3014a — Filesystem access.
pkgs/npm/@[email protected]/src/core/credentials.ts:258 
    raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #113d6089183d3b6d — Filesystem access.
pkgs/npm/@[email protected]/src/core/credentials.ts:372 
    return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d5664e96579db83b — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/credential-chain.ts:250 
      const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c11059528e421c4b — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/identity-token.ts:17 
      content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1838eebfa553400b — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/types.ts:222 
      await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d00414bdff0156a1 — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:45 
      raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9c2b97e0f0ebe9fc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:58 
    return this._client.get(path`/v1/agents/${agentID}?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3768ab68b7644227 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:86 
    return this._client.post(path`/v1/agents/${agentID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f7f2d1bab54ee66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:139 
    return this._client.post(path`/v1/agents/${agentID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9cc91af9ec8fbaeb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployment-runs.ts:30 
    return this._client.get(path`/v1/deployment_runs/${deploymentRunID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fedfc9b908720bcc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:69 
    return this._client.get(path`/v1/deployments/${deploymentID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7ebbaa92a859283d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:95 
    return this._client.post(path`/v1/deployments/${deploymentID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #61a111d08098069b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:148 
    return this._client.post(path`/v1/deployments/${deploymentID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f48606356345d165 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:174 
    return this._client.post(path`/v1/deployments/${deploymentID}/pause?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #07f56847caeb2d6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:200 
    return this._client.post(path`/v1/deployments/${deploymentID}/run?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e865bbc626ace59 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:226 
    return this._client.post(path`/v1/deployments/${deploymentID}/unpause?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #caa8a6e4e9e91988 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:51 
    return this._client.get(path`/v1/dreams/${dreamID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1fbc28d2d750ce59 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:102 
    return this._client.post(path`/v1/dreams/${dreamID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a46346567a9ab189 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:127 
    return this._client.post(path`/v1/dreams/${dreamID}/cancel?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #398ac4a6e28bdfa6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:74 
    return this._client.get(path`/v1/environments/${environmentID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7c707888665b265f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:100 
    return this._client.post(path`/v1/environments/${environmentID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #afb85f7576c72000 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:180 
    return this._client.post(path`/v1/environments/${environmentID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #923fd72cd63008c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:43 
    return this._client.get(path`/v1/environments/${environment_id}/work/${workID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bb0c637dfccad229 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:71 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #19a52220156a100f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:138 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}/ack?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #354f99f5a7547dd6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:169 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}/heartbeat?beta=true`, {
      query: { desired_ttl_seconds, expected_last_heartbeat },
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3f9483fc5192b9c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:201 
    return this._client.get(path`/v1/environments/${environmentID}/work/poll?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        {
          'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString(),
          ...(anthropicWorkerID != null ? { 'Anthropic-Worker-ID': anthropicWorkerID } : undefined),
        },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c168b8efb0b646d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:231 
    return this._client.get(path`/v1/environments/${environmentID}/work/stats?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #030f9ca412d54800 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:258 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}/stop?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #abae061ce5cac6b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/files.ts:85 
    return this._client.get(path`/v1/files/${fileID}/content?beta=true`, {
      ...options,
      headers: buildHeaders([
        {
          'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString(),
          Accept: 'application/binary',
        },
        options?.headers,
      ]),
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42c06170e488cd22 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/files.ts:113 
    return this._client.get(path`/v1/files/${fileID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ecbafed5a8076160 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:30 
    return this._client.post(path`/v1/memory_stores/${memoryStoreID}/memories?beta=true`, {
      query: { view },
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5d9d4186068f6db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:59 
    return this._client.get(path`/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #81463b13f64e8a12 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:87 
    return this._client.post(path`/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
      query: { view },
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a4681d032343ae85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:91 
    return this._client.get(path`/v1/memory_stores/${memoryStoreID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b248dffde03762a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:115 
    return this._client.post(path`/v1/memory_stores/${memoryStoreID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4d53117fe66f440d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:190 
    return this._client.post(path`/v1/memory_stores/${memoryStoreID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bc81aa7d81374a67 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-versions.ts:31 
    return this._client.get(
      path`/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}?beta=true`,
      {
        query,
        ...options,
        headers: buildHeaders([
          { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
          options?.headers,
        ]),
      },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3c6129066833b71d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-versions.ts:95 
    return this._client.post(
      path`/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}/redact?beta=true`,
      {
        ...options,
        headers: buildHeaders([
          { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
          options?.headers,
        ]),
      },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a00416bf1c5ea06c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:82 
    return this._client.get(path`/v1/messages/batches/${messageBatchID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b1592bb92dc83be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:181 
    return this._client.post(path`/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7e6d7144875d3ae5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:221 
    return this._client
      .get(batch.results_url, {
        ...options,
        headers: buildHeaders([
          {
            'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString(),
            Accept: 'application/binary',
          },
          options?.headers,
        ]),
        stream: true,
        __binaryResponse: true,
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #67800bd42bd1a6c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/models.ts:31 
    return this._client.get(path`/v1/models/${modelID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ae56c62febecbb24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/events.ts:82 
    return this._client.post(path`/v1/sessions/${sessionID}/events?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0f1a63896064b747 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/events.ts:109 
    return this._client.get(path`/v1/sessions/${sessionID}/events/stream?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
      stream: true,
    }) as APIPromise<Stream<BetaManagedAgentsStreamSessionEvents>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fd317e962d511484 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:31 
    return this._client.get(path`/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a913710ae791ed7b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:61 
    return this._client.post(path`/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #873c5fdcb87a24ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:152 
    return this._client.post(path`/v1/sessions/${sessionID}/resources?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #acc2be18b533b077 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:174 
    return this._client.get(path`/v1/sessions/${sessionID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #73aa3ba4fbc6e50a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:200 
    return this._client.post(path`/v1/sessions/${sessionID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad5c30c1523bff54 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:283 
    return this._client.post(path`/v1/sessions/${sessionID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0fb8d0a7b038026e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/events.ts:68 
    return this._client.get(path`/v1/sessions/${session_id}/threads/${threadID}/stream?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
      stream: true,
    }) as APIPromise<Stream<ThreadsAPI.BetaManagedAgentsStreamSessionThreadEvents>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e9dabc35d6a9ccc7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/threads.ts:37 
    return this._client.get(path`/v1/sessions/${session_id}/threads/${threadID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #898b5de8eb7cf47c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/threads.ts:97 
    return this._client.post(path`/v1/sessions/${session_id}/threads/${threadID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #83232b963e900310 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/skills.ts:73 
    return this._client.get(path`/v1/skills/${skillID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a7627f4e4ef3ece8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:31 
    return this._client.post(
      path`/v1/skills/${skillID}/versions?beta=true`,
      multipartFormRequestOptions(
        {
          body,
          ...options,
          headers: buildHeaders([
            { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
            options?.headers,
          ]),
        },
        this._client,
        false,
      ),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #80a1d267b88c6133 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:65 
    return this._client.get(path`/v1/skills/${skill_id}/versions/${version}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9436faf8aca5bd05 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:149 
    return this._client.get(path`/v1/skills/${skill_id}/versions/${version}/content?beta=true`, {
      ...options,
      headers: buildHeaders([
        {
          'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString(),
          Accept: 'application/binary',
        },
        options?.headers,
      ]),
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #27ef7e6902a6d575 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:37 
    return this._client.post(path`/v1/tunnels/${tunnelID}/certificates?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #65d3f4d364954ed5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:70 
    return this._client.get(path`/v1/tunnels/${tunnel_id}/certificates/${certificateID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f9bf92bebab9e9da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:144 
    return this._client.post(path`/v1/tunnels/${tunnel_id}/certificates/${certificateID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9f46a63766d4516e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:72 
    return this._client.get(path`/v1/tunnels/${tunnelID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #acf6fac91d099eaf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:137 
    return this._client.post(path`/v1/tunnels/${tunnelID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a8fd75060b392708 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:169 
    return this._client.post(path`/v1/tunnels/${tunnelID}/reveal_token?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #156e85acd8dc3cdf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:200 
    return this._client.post(path`/v1/tunnels/${tunnelID}/rotate_token?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fca91f4d1bdaadd7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:50 
    return this._client.get(path`/v1/user_profiles/${userProfileID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #31f0513fbfae9afd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:76 
    return this._client.post(path`/v1/user_profiles/${userProfileID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #842504f843b2b749 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:129 
    return this._client.post(path`/v1/user_profiles/${userProfileID}/enrollment_url?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f8f16498a51bcc3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:37 
    return this._client.post(path`/v1/vaults/${vaultID}/credentials?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13b487ea5fa418a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:65 
    return this._client.get(path`/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be162954417c7730 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:92 
    return this._client.post(path`/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8c220ca78fe70436 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:180 
    return this._client.post(path`/v1/vaults/${vault_id}/credentials/${credentialID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #065db858942bf70b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:207 
    return this._client.post(
      path`/v1/vaults/${vault_id}/credentials/${credentialID}/mcp_oauth_validate?beta=true`,
      {
        ...options,
        headers: buildHeaders([
          { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
          options?.headers,
        ]),
      },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21c44e22f0cc7f1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:101 
    return this._client.get(path`/v1/vaults/${vaultID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fbeb87387683e51b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:127 
    return this._client.post(path`/v1/vaults/${vaultID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ee8ee1ad6d60478 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:206 
    return this._client.post(path`/v1/vaults/${vaultID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f58cf96b942bd9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:71 
    return this._client.get(path`/v1/messages/batches/${messageBatchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d446fdcf035b1c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:137 
    return this._client.post(path`/v1/messages/batches/${messageBatchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a41339beff0ac116 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:167 
    return this._client
      .get(batch.results_url, {
        ...options,
        headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
        stream: true,
        __binaryResponse: true,
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #af97511e1ee564d9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/models.ts:24 
    return this._client.get(path`/v1/models/${modelID}`, {
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #41db2b161b82298d — Filesystem access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/fs-util.ts:112 
    await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fb949ba22d4bd4bb — Filesystem access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:457 
        data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #35b4a84997ec7bef — Filesystem access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:533 
        data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cf57937eddc7b8cb — Environment-variable access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:806 
  const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6573656f05f44abd — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:4 
import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3572b09797e4435e — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:52 
    await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f8a1da2908f01458 — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:101 
    return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #99f75cce3212e803 — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:256 
      await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3980db013706a31d — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.js:115 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9d0784b9b07d7949 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.mjs:107 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f131704bc91f923a — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:390 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f8203555c1607a5d — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:469 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #250ac1e66e7bd50d — Environment-variable access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:755 
    const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2dd7d609bc424af7 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:375 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #822cdaf5c2947e64 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:454 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ddf2d2ea1e4d4022 — Environment-variable access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:740 
    const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1faea6128c95c244 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.js:43 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #140fcdbdd805e0c2 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.js:91 
        return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #85148ab761c71331 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.js:213 
            await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fbcb9c3241e063f4 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:2 
import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7c79314c4ac68863 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:38 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ac4ed8f08142919d — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:86 
        return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5773c3148556f1eb — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:208 
            await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

posthog-node

npm dependency
medium telemetry dependency Excluded from app score #1bac5aa322794f59 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:69 
    posthog.withContext(buildRequestContextData(posthog, req), () => next())

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #f571e28404156637 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:98 
    posthog.addPendingPromise(
      ErrorTracking.buildEventMessage(
        posthog.getErrorPropertiesBuilder(),
        error,
        hint,
        contextData.distinctId,
        additionalProperties
      ).then((msg) => {
        return posthog._capturePreparedEvent(msg, false)
      })
    )

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #4650c1e87727272d — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:100 
        posthog.getErrorPropertiesBuilder(),

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
medium telemetry dependency Excluded from app score #7d297362790b8734 — Telemetry/analytics SDK usage detected. Confirm user consent and that no PII is sent without a lawful basis.
pkgs/npm/[email protected]/src/extensions/express.ts:106 
        return posthog._capturePreparedEvent(msg, false)

A telemetry/analytics SDK is used; event data is sent to a third-party collector.

Fix: Ensure user consent and a lawful basis; strip PII from event payloads.
expand_more 2 low-confidence finding(s)
low egress dependency Excluded from app score #cd56f6528559a480 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/client.ts:411 
    return this.options.fetch ? this.options.fetch(url, options) : fetch(url, options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d5510ef5252ca941 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/extensions/feature-flags/feature-flags.ts:1006 
      return fetch(url, options)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@brave/brave-search-mcp-server

npm dependency
medium pii_flow dependency Excluded from app score #e25e6e0855b88f0c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/src/config.ts:135 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]__reposrc/src/config.ts:77 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]__reposrc/src/config.ts:135 
    console.error(
      `Invalid --transport value: '${options.transport}'. Must be one of: stdio, http.`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6410bb1dda9c12cf — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/src/config.ts:142 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]__reposrc/src/config.ts:77 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]__reposrc/src/config.ts:142 
    console.error(
      `Invalid --logging-level value: '${options.loggingLevel}'. Must be one of: ${LoggingLevelSchema.options.join(', ')}`
    );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #79244648bec050e7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/src/config.ts:157 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]__reposrc/src/config.ts:77 → /tmp/closeopen-1_0nwmaz/pkgs/npm/@[email protected]__reposrc/src/config.ts:157 
      console.error(
        `Invalid --port value: '${options.port}'. Must be a valid port number between 1 and 65535.`
      );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 11 low-confidence finding(s)
low egress dependency Excluded from app score #3176d0828fffe26a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/BraveAPI/index.ts:94 
  const response = await fetch(urlWithParams, { headers });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #846963cadfbd34bf — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:14 
    .default(process.env.BRAVE_API_KEY ?? ''),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e97f082ee1208d01 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:61 
  braveApiKey: process.env.BRAVE_API_KEY ?? '',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0c560049b8170cf — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:77 
    .option('--brave-api-key <string>', 'Brave API key', process.env.BRAVE_API_KEY ?? '')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ff681e7ccbdfc4a4 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:78 
    .option('--logging-level <string>', 'Logging level', process.env.BRAVE_MCP_LOG_LEVEL ?? 'info')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ffd48e0f8718ccdc — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:82 
      process.env.BRAVE_MCP_TRANSPORT ?? 'stdio'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c531e6ca625bb8ec — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:87 
      process.env.BRAVE_MCP_ENABLED_TOOLS?.trim().split(' ') ?? []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a040599c676354a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:92 
      process.env.BRAVE_MCP_DISABLED_TOOLS?.trim().split(' ') ?? []

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4da8e49db4f24058 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:97 
      process.env.BRAVE_MCP_PORT ?? '8080'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d6c89724ba32cab — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:102 
      process.env.BRAVE_MCP_HOST ?? '0.0.0.0'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #73f423881c023064 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/config.ts:107 
      process.env.BRAVE_MCP_STATELESS === 'true' ? true : false

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

winston

npm dependency
medium pii_flow dependency Excluded from app score #b93e6cb86916a035 — Credentials parsed from the request URL are applied as authorization on the same outbound HTTP request. This is intentional URL authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/lib/winston/transports/http.js:242 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/lib/winston/transports/http.js:249 → /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]/lib/winston/transports/http.js:242 
    const req = (this.ssl ? https : http).request({
      ...this.options,
      method: 'POST',
      host: this.host,
      port: this.port,
      path: `/${path.replace(/^\//, '')}`,
      headers: headers,
      auth: (auth && auth.username && auth.password) ? (`${auth.username}:${auth.password}`) : '',
      agent: this.agent
    });

User/PII-bearing data flows to an external sink — the classic data-exfiltration shape.

Fix: Confirm no user identifiers reach this sink; redact/hash before sending, or remove the flow.
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #87ba2aec0d4ae0ae — Filesystem access.
pkgs/npm/[email protected]/lib/winston/tail-file.js:10 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d5d658195852f3c — Filesystem access.
pkgs/npm/[email protected]/lib/winston/transports/file.js:11 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #855291d543eb3957 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/lib/winston/transports/http.js:242 
    const req = (this.ssl ? https : http).request({
      ...this.options,
      method: 'POST',
      host: this.host,
      port: this.port,
      path: `/${path.replace(/^\//, '')}`,
      headers: headers,
      auth: (auth && auth.username && auth.password) ? (`${auth.username}:${auth.password}`) : '',
      agent: this.agent
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

winston-azure-blob

npm dependency
medium pii_flow tooling Excluded from app score unknown #76dd2130cf3fe1e8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/[email protected]__reposrc/examples/index.ts:33 · flow /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]__reposrc/examples/index.ts:19 → /tmp/closeopen-1_0nwmaz/pkgs/npm/[email protected]__reposrc/examples/index.ts:33 
    logger.info(`index ${v} sample log ${randAnimalType()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 2 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #2ad8d1a487c072de — Environment-variable access.
pkgs/npm/[email protected]__reposrc/examples/index.ts:18 
                host: process.env.HOST || "host",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2a9757ace14de2fb — Environment-variable access.
pkgs/npm/[email protected]__reposrc/examples/index.ts:19 
                sasToken: process.env.SAS_TOKEN || "sasToken",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@apidevtools/json-schema-ref-parser

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #de3a643d12aeb4a3 — Filesystem access.
pkgs/npm/@[email protected]/lib/resolvers/file.ts:39 
      return await fs.promises.readFile(path);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #81aede14b2a3cf0d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/resolvers/http.ts:137 
  const response = await fetch(u, {
    method: "GET",
    headers: httpOptions.headers || {},
    credentials: httpOptions.withCredentials ? "include" : "same-origin",
    redirect: "manual",
    signal: controller ? controller.signal : null,
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@datastax/astra-db-ts

npm dependency
expand_more 16 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #3481d4c04a11f153 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/examples/http2-when-minified/src/app/route.ts:6 
const client = new DataAPIClient(process.env.ASTRA_DB_TOKEN!, {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #72f648becb52e351 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/examples/http2-when-minified/src/app/route.ts:11 
const db = client.db(process.env.ASTRA_DB_ENDPOINT!);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #641e733fbb2f876a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/examples/nextjs/src/app/route.ts:6 
const client = new DataAPIClient(process.env.ASTRA_DB_TOKEN!);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6360e2384b5be487 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/examples/nextjs/src/app/route.ts:7 
const db = client.db(process.env.ASTRA_DB_ENDPOINT!);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2b628db113de0c7c — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/add-license-bumf.js:1 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #64a6c01ba0c5066d — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/add-license-bumf.js:23 
fs.readFile(filePath, 'utf8', (err, data) => {
  if (err) {
    throw new Error('Error reading file ${filePath}: ${err}');
  }

  fs.writeFile(filePath, bumf + '\n\n' + data, 'utf8', (err) => {
    if (err) {
      throw new Error('Error writing file ${filePath}: ${err}');
    }
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #be29377c7bb39455 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/add-license-bumf.js:28 
  fs.writeFile(filePath, bumf + '\n\n' + data, 'utf8', (err) => {
    if (err) {
      throw new Error('Error writing file ${filePath}: ${err}');
    }
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #199891ad137c5647 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/del-empty-dist-files.js:1 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e821a18b6e8f996c — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/del-empty-dist-files.js:29 
        fs.readFile(filePath, 'utf8', (err, data) => {
          if (err) {
            return console.error('Error reading file: ' + err);
          }

          if (data === targetContent) {
            fs.unlink(filePath, (err) => err && console.error('Error deleting file: ' + err));
          }
        });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cde9fabd8d703e9b — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/reduce-comments.js:1 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0dab49880212f9bb — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/reduce-comments.js:27 
fs.readFile(filePath, 'utf8', (err, data) => {
  if (err) {
    throw new Error('Error reading file ${filePath}: ${err}');
  }

  const withShortenedLicense = data.replace(longBumf, shortBumf);
  const withStrippedBlockComments = strip.block(withShortenedLicense);

  fs.writeFile(filePath, withStrippedBlockComments, 'utf8', (err) => {
    if (err) {
      throw new Error('Error writing file ${filePath}: ${err}');
    }
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #556a85ff0930466f — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/utils/reduce-comments.js:35 
  fs.writeFile(filePath, withStrippedBlockComments, 'utf8', (err) => {
    if (err) {
      throw new Error('Error writing file ${filePath}: ${err}');
    }
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #e7391be27d02a90b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/api/fetch/fetch-native.ts:35 
      const resp = await fetch(info.url, init);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c1a426b69f8a2c20 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/devops/astra-admin.ts:252 
    const resp = await this.#httpClient.request({
      method: HttpMethods.Get,
      path: `/databases/${id}`,
    }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #17e76ed349f9cbd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/devops/astra-admin.ts:305 
    const resp = await this.#httpClient.request({
      method: HttpMethods.Get,
      path: `/databases`,
      params: params,
    }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #93b55d16d77b2481 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/devops/astra-db-admin.ts:171 
    const resp = await this.#httpClient.request({
      method: HttpMethods.Get,
      path: `/databases/${this.#db.id}`,
    }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@dqbd/tiktoken

npm dependency
expand_more 8 low-confidence finding(s)
low egress dependency Excluded from app score #2e9533f48a6ee072 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lite/load.cjs:148 
        : (url) => fetch(url).then((r) => r.text());

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d07cd46362aac56d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lite/load.js:145 
        : (url) => fetch(url).then((r) => r.text());

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #8edcf82c52f58602 — Filesystem access.
pkgs/npm/@[email protected]/lite/tiktoken.cjs:5 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8e80792ba0bb59f — Filesystem access.
pkgs/npm/@[email protected]/lite/tiktoken.cjs:29 
    bytes = fs.readFileSync(candidate);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #5460640ee37fec3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/load.cjs:148 
        : (url) => fetch(url).then((r) => r.text());

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a566859f9e1c1077 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/load.js:145 
        : (url) => fetch(url).then((r) => r.text());

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #e8ddc2403a3c576b — Filesystem access.
pkgs/npm/@[email protected]/tiktoken.cjs:5 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #376c65f6029f0000 — Filesystem access.
pkgs/npm/@[email protected]/tiktoken.cjs:29 
    bytes = fs.readFileSync(candidate);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@e2b/code-interpreter

npm dependency
expand_more 5 low-confidence finding(s)
low egress dependency Excluded from app score #e81d005173504cce — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/sandbox.ts:227 
      const res = await fetch(`${this.jupyterUrl}/execute`, {
        method: 'POST',
        headers,
        body: JSON.stringify({
          code,
          context_id: opts?.context?.id,
          language: opts?.language,
          env_vars: opts?.envs,
        }),
        signal: controller.signal,
        keepalive: true,
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #12635411546f780c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/sandbox.ts:303 
      const res = await fetch(`${this.jupyterUrl}/contexts`, {
        method: 'POST',
        headers,
        body: JSON.stringify({
          language: opts?.language,
          cwd: opts?.cwd,
        }),
        keepalive: true,
        signal: this.connectionConfig.getSignal(opts?.requestTimeoutMs),
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e15b4be05eb35143 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/sandbox.ts:343 
      const res = await fetch(`${this.jupyterUrl}/contexts/${id}`, {
        method: 'DELETE',
        headers,
        keepalive: true,
        signal: this.connectionConfig.getSignal(
          this.connectionConfig.requestTimeoutMs
        ),
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f06055bfcbbde36 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/sandbox.ts:376 
      const res = await fetch(`${this.jupyterUrl}/contexts`, {
        method: 'GET',
        headers,
        keepalive: true,
        signal: this.connectionConfig.getSignal(
          this.connectionConfig.requestTimeoutMs
        ),
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d168b2c28ba4b958 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/sandbox.ts:414 
      const res = await fetch(`${this.jupyterUrl}/contexts/${id}/restart`, {
        method: 'POST',
        headers,
        keepalive: true,
        signal: this.connectionConfig.getSignal(
          this.connectionConfig.requestTimeoutMs
        ),
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@elastic/elasticsearch

npm dependency
expand_more 1174 low-confidence finding(s)
low egress dependency Excluded from app score #049fad5bf5349052 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/async_search.js:176 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b73ac2b693d3ce62 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/async_search.js:214 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e94ca9b4bf6ec539 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/async_search.js:252 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #05e12f7db81d50e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/async_search.js:316 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7d70cbf1c1a06e47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/autoscaling.js:100 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #548b267606a45791 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/autoscaling.js:136 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #889ee3f204d90690 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/autoscaling.js:174 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a86211bfdfa414d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/autoscaling.js:215 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #08c22f05dd4a8a49 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/bulk.js:85 
    return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #80039865211ca1dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cancel_reindex.js:52 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aab518052fe5956c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/capabilities.js:53 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #edf640d386895189 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:383 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #24d461604be41796 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:430 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a93fc7ae08d970ae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:477 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #59ef4cac4dc5f2fe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:524 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #251520e66e795751 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:583 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #906540bb94cf30fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:630 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0857b43dd09271be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:666 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dcfb80e015080f29 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:702 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d62006b2f229dac8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:749 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #00973988cc87fbe9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:785 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9bdffe2b6074785f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:832 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be5c05a39a9357f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:879 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c2626be588125492 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:926 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ebeb7cc18550b664 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:973 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dc781c698bdc5996 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1009 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c87cd8725ba453d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1045 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d09d013d1858ce7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1081 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f7568d6db2b36060 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1117 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c4232185ea1f3d86 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1164 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d905bb1d87220e0b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1200 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d4a350c764b572e1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1247 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #176ab415504808be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1294 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7490ba2794eddb65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1341 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #945aa8e2bdce28d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1377 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f4be555ecb1fcee4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1424 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4a9782f8974a3a5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1471 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #65f5c6bc0fb5a530 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cat.js:1518 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #724e2e73ed3b54dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:226 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #acc36fe9c974d70a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:276 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #38bebef94a088e1c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:314 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b733254fd322b7b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:352 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6b51b8a92678a237 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:402 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8579f3abf6c9e90d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:449 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e342e30fb04f3a9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:487 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0bc2c38ffad8e78f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:525 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #939f6abfc3b515a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:575 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7cc765379b5c421d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:613 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f7cde80d8c05831 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:663 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7413606349f40943 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:699 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9d4a5f7f935a4d3c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ccr.js:737 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #38d23987e6cd32a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/clear_scroll.js:66 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #88e7d08ffc6e76b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/close_point_in_time.js:60 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f5df97909d986b85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:259 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eef1579c6f255a3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:297 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8ce208cd2d48e47b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:333 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ebe1f77f6a51ff47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:371 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d1c9a4e88ebc5e97 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:418 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3415fd53f5837460 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:454 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d88f67f8341f959 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:501 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6fc99b95af9f7c3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:539 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6715b051772558dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:575 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #92608697843eed93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:611 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #092716dc27ccb525 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:661 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c06e3d1208ab37be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:709 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5d5f5c6da98da78e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:745 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79837ad54230b319 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:793 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #81f7717d654fb4d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:845 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a86c758cdb9f8fb7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/cluster.js:892 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #29d361aa35e55bb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:387 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #492ae45fd0e6d060 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:425 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1a2ceea32769477b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:463 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dde777deabdb715f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:513 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8a717ab0c284f3ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:549 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #34e19f9a966eaf5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:597 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7bbf7d537d20485e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:656 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f39cf5ce6e7705d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:694 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #55ff5e5ff976888e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:732 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9f82736234408c16 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:780 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #62c0b1065c95a187 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:830 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #163344bef96bf468 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:868 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #90147bc114e5f442 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:906 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c31614c2306c3fd4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:956 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b7631bd92723dc27 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:994 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a4c45ef3408225a9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1044 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #17613ff488211f68 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1082 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3005fd807ed34da8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1118 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bf8df2623f925c49 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1165 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9610cc113a6ee913 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1215 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #040d39a69ce089b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1253 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ba32d0b9bdc33ebf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1303 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #168d0f1f8a41e172 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1353 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56556af12f24d8ba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1403 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cfc3151d13a5d94e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1453 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #088c25e74255ba38 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1503 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0af662e794ffff40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1553 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8c4dbfe4652114eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1603 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b454f51c43e9aa01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1653 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42c14de2bd1304cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1703 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9669861aabb5fd59 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1753 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb8cc1c60b30e3aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1803 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7a8f8da363196a6e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1853 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4dfea379e4ba917a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/connector.js:1903 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d834376c5ac31b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/count.js:90 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a6c78d3168159b2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/create.js:69 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #347ccbf2cf1e0fdb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/dangling_indices.js:88 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #76a7240876aa60f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/dangling_indices.js:126 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a760440328e7c5c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/dangling_indices.js:162 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5ae2109e3ef00467 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/delete.js:61 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2653f8fa85c4b26c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/delete_by_query.js:98 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79c8b90906ee07ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/delete_by_query_rethrottle.js:52 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #59a33c67771601b9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/delete_script.js:53 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cea556d8cd85f166 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/enrich.js:110 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc3a64d64a0426cf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/enrich.js:148 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #35a876500f8c9d71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/enrich.js:195 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #571f03db3e55dfab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/enrich.js:245 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7edfaa42c5a9b5e2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/enrich.js:281 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f2d23a6ce1abcd65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/eql.js:122 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d5dbdd584030f811 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/eql.js:160 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #114d13ac3f913d79 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/eql.js:198 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #429ade0a61858d1e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/eql.js:248 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bafea4ea2e2fbf9b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:181 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8abd9c6b9d249606 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:219 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6bf0f01f125b7343 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:257 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #af0fbb3b5404290c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:295 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3b17aafc5ab0516d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:333 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d5db41923411b24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:371 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b7613deb52e98809 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:418 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a0cb4fd346efe707 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:454 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #86d2a1b9c879e35c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:504 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3453483136967b5b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/esql.js:551 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c11081c1aad8e1de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/exists.js:63 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e45b62f981018196 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/exists_source.js:62 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c965cacd74cf42b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/explain.js:80 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b991a886deffa4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/features.js:73 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #188fea6a29a53fae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/features.js:109 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f8eb3b1954ace3f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/field_caps.js:86 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7dbc86ae459bb8a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/fleet.js:202 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e9cd1ebbe5b3b3da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/fleet.js:240 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #16bfd91dc40a0701 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/fleet.js:278 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9a07ee83a239b5c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/fleet.js:327 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8e223d78889ac0af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/fleet.js:374 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3695f48e9aeba94a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/fleet.js:424 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #01b931c3c3c013d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/get.js:65 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cf9ffdf578281fa1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/get_reindex.js:53 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #60478e0eb9a77528 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/get_script.js:52 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c2c8380203866fd1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/get_script_context.js:46 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2d40837a3d85b565 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/get_script_languages.js:46 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02e9a2eb959a88aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/get_source.js:62 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56028f40f915b25c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/graph.js:89 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64b47b3ea38b552c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/health_report.js:63 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1dc4fac36de6a188 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:161 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #57897317937a187e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:199 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4e94f42a27ddd30e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:246 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cd03349474b42776 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:282 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #950d9ca02f1c3984 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:330 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #807da745edf80046 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:380 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3cb9ff2e313f5b13 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:430 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b3d68fdc7ed765f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:468 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5630e12ac11b6586 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:506 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7c1c4e919b4180d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:542 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #979f68f9a8171c80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ilm.js:578 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5b1da0760db6a7f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/index.js:80 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eb4d249d2b6bfae3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:987 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #322f4287e90f0677 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1046 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #12172210b1ba18a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1084 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e969363716ebad9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1131 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #198e772613884400 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1182 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9e769a97cea9ef39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1220 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ac5732945e2229e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1270 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4e456ced6e79adc1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1308 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0dd84f9033692cb3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1350 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4b7ee3b38d509847 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1397 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #49d2abc4682ced75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1435 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ff4892046f66728a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1482 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ed7a61eef51d886e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1520 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8e91773424de9ea8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1558 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #691ca9ce86b1f920 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1596 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0f361ad2f1ab045d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1634 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5205c0228b144fa2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1672 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8cdcbc1e477c17e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1710 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7fcca760e21c1939 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1752 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5f223260194c82dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1790 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #829852168ce91a73 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1837 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1f11e02bb3657a2d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1875 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #50cc9178ed07a500 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1913 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac0da0e364df3fa4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1951 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2cde7da829635b46 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:1989 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3c53626e20b9567a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2036 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df445c920c4b9d07 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2083 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a49595b922b51f6d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2121 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5a916d95b9d02b51 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2177 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc1a8c15e22e54f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2215 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f72887a7583608a9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2251 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #80cb3b3ecfd0eae5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2298 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e90a4b62f2bad56a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2336 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #74043a462781c943 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2374 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8eb55d5ba53b9d07 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2412 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ebb14276ecd4e638 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2459 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5883b6196b1451ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2506 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d11d48789e8d674e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2553 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bd1bfb801295aa15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2591 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eebada66e892782c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2647 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #45035e8354f1ac39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2694 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #54eae265abdd1e94 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2732 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #196e26776e7808ae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2770 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f7befa0bb0edec1c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2817 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #094c3365c09f773f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2855 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e8a0b7588c02f86f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2893 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6d366e3bddcd3edc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:2952 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #53801d68a2bb1d8c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3002 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #36d3218a12414f6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3043 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fe1af47af93b5455 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3093 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3b6f2a5968ee232f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3134 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3aa734bb53e1db30 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3184 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #644923e48213340c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3234 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d20e953dee4749a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3283 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4c7537677a4b9fcb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3333 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f3c5b806e49e7bb1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3380 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6d4b195ecead27ce — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3427 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac53e3a6d512a857 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3465 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b46f2615ada5b79d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3504 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dd78205fb3802788 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3551 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b847122b16723250 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3601 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8e80f8a45588f785 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3660 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #59ac95daaa113a17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3707 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9bcdaf6bd38dd8cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3754 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #db2d4d29626aee77 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3805 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b87ae4267a7aad7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3846 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #62c8e7f146ff611e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3905 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7895c37de2a69716 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:3956 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4890da6fb82e14f7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:4012 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #001a462e1b9f6584 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:4060 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1f6878e48222f48a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/indices.js:4119 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1e62b3dbb7e4465d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:582 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3bf13418b0dffeb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:632 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f22c496ee36d14b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:679 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b2ecb3cc44c95122 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:720 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c90cd8884a2fe1da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:776 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13b79e4edf19e0c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:835 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4d25eee44ddda97e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:885 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8809bd7850d4da2a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:936 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef05da60c28a05ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:987 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #11534f4e9a1ee718 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1038 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64d08862c5e92e09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1089 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec21f73b8ec6ed3d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1140 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #583e244a2ad02ceb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1191 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5efa6fa9e67e12c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1242 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f59dca6467a96275 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1293 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0e6397e5ddbfdc87 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1344 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6613021fc444dbde — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1395 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #635729b25af424cf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1446 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #67eccf0cd5205299 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1497 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9fe250fdaf7fdedb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1548 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e131197bf9e964e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1599 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3e88c12a2774e84c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1650 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bb5cec2e63951839 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1701 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8025b37b07eabeeb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1752 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9370c7926ab09f33 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1803 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3dfcfdaa31c14000 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1854 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #edea038e4a5af836 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1905 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #18a7739017a209ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:1956 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8643e10ff801a842 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2007 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #053428ffbaa710eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2058 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56266e1b0a59efc3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2109 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0e25ae87909aef0c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2160 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b563fecf6a617a36 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2211 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64fe652550bd5062 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2261 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d0e58329a1f1c26d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2311 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c4f331d098baa48e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2361 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a865efdf498882ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2411 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b07d7e10f280502 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/inference.js:2461 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a5eb5dbe75ffbff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/info.js:46 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f8e2192761d9bf15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:182 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #17a10906c7b77f5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:220 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7484bbe3e6f2f944 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:258 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad67e260158f7f34 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:294 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #30d0f19b6de6be3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:341 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f285041a894da120 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:388 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e02695c6221f96b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:435 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0fd7fc2dc41c30d2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:471 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac0afa0842966009 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:521 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #897c23ba078c3687 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:562 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8959eff3e1df5528 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:612 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f0f9959011da079b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ingest.js:670 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dca516fef66ca9ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/knn_search.js:72 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4dac9b0f19e98a26 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/license.js:116 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e44ca63db20660de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/license.js:152 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d91e1558ecc9741d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/license.js:188 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4a34976e357deb17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/license.js:224 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f3837230cb75171b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/license.js:272 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #29b5b29fd02f2657 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/license.js:308 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1fdcc8d8ed03b493 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/license.js:344 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #225ac1707d8568ce — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/list_reindex.js:48 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #39516ee0f7fcc3b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/logstash.js:85 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1826494863f7b227 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/logstash.js:132 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ae091f03f574707f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/logstash.js:173 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #70bd06db0298aa4b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/mget.js:85 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec3855c98336f4e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/migration.js:87 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #012879372cd72423 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/migration.js:123 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #47b99566a8ca0cdf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/migration.js:159 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cfe8cb8ae98adafa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1011 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb02f9aff82c380b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1061 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0844f2f5b943158f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1099 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4e86d9abe29bf8e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1138 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a91e70ce2223373e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1177 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #485c9e11ca59870e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1215 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3a57d7e1a2f6cd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1253 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3b7db7e2b3430a92 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1312 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be5252528c2ec968 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1350 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dbd5f05c55af3e60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1397 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f0c8ddf91a236a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1435 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d6e919108f6aa567 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1474 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8ae5d1b40f3ce05c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1512 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3d2db4eb6f54bf7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1551 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9f27f8c4942b650a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1599 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4252102b16658e71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1646 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec546f5f6179d29e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1705 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #777df60f6ba9517e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1755 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f4a5a8b30cc4d74 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1805 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2205a3a035b8b21 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1864 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f81c76dfc579a7a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1902 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e380da1d88268032 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:1961 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #263b26ad30dd3e5b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2020 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #67c85c467d25f3dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2067 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c9f58189bf65f44a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2114 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #38efb7cf79e71486 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2161 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d99ae0b46327775d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2208 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b325b295cbd3877d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2255 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb1622b397b0c2ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2305 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64ba3e983bb7a2ae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2352 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #41c56a2177d02307 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2399 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #06cf1e78f4331504 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2446 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e389df64c13ba92 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2485 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad41840940926e8e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2544 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bda5ba38bb57201d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2594 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0abe7e95aef40b9d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2644 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8a8c91fa534eaa24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2691 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #615547a2086c72b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2738 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #06bedaf8ac9dd022 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2788 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5cd60248be94f890 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2824 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1df6902053884c86 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2874 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5844307283d87047 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2924 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3cea134add4e7cda — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:2965 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #28646162133cbe10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3024 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #51c724f55b373cd4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3083 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0656fa67325c51a9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3133 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c7261d630d169180 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3172 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #19ba384183303687 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3222 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37743ff5e0850b60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3272 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c4a57703322e7a0b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3322 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #176ff7c650f61778 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3372 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56c46520cbe79403 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3422 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d8d4dd5a98982608 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3461 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #09736702b65c7ab0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3512 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d2f7cabdb7fddb2e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3562 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7b60395c468145e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3600 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8c06390bae7a3f12 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3651 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6fb3ab970de40bd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3687 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #43f43e2cb660198f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3737 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #742c87f36025b597 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3787 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d856d9af2f342f5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3837 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d5274adfad5f11bf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3887 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #30a047d0c46318a2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3937 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #44a31fa74ac12302 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:3987 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ffc4b0bad67eed22 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4037 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dfda6d21307dd068 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4087 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #63b799d854d377bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4137 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca6174340dca8a49 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4187 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #75375b20f131343c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4238 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cd7c51bcecca8f8f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4288 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b6b767af179e5296 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4327 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3e6f24f744b24239 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4375 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #91f2cd204575ebfd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ml.js:4413 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c0fb14e8f2dfcdd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/monitoring.js:73 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #48648fae9d0c65a4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/msearch.js:80 
    return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13da0cea7a7f5470 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/msearch_template.js:71 
    return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d1df10ebb9719aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/mtermvectors.js:88 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #675b355ce3d439b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/nodes.js:144 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b0155fbf9ca634ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/nodes.js:182 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d4d7d652a741392 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/nodes.js:229 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #642f42fc0dac0c30 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/nodes.js:285 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f3f01a888d239541 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/nodes.js:344 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c4a32102ddaebbdd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/nodes.js:409 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e0f256bfda50be3d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/nodes.js:465 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9eaa916ac35f3b66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/open_point_in_time.js:74 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #31127542503d0748 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ping.js:46 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #73596718494cdb7b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/profiling.js:92 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #89307f70975bee92 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/profiling.js:130 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #95a033e9743f6999 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/profiling.js:166 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #259ac72020869f72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/profiling.js:204 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #50e63182a57456ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/project.js:104 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #beff79165944b585 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/project.js:145 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b4bb47df90948ff7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/project.js:183 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b2ee3d5e4f39182e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/project.js:219 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #001afed4a6e71bac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/project.js:257 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8b4b8565a84b1570 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/project.js:305 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6656b529ba5f11cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/put_script.js:79 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #92d52d9af20591cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:132 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c7dd0b04b4835dd0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:170 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b0fa1434a53267d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:209 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #592add661cd328f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:247 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #58a2fe6c64326cb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:283 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #780e1e45641f2c7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:334 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef500c8cfd34f36b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:384 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1e79e4a150efa1d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/query_rules.js:434 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4e084bcf8c3b3240 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rank_eval.js:79 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #43b008fc672ca986 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/reindex.js:74 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #126893eb30d97783 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/reindex_rethrottle.js:53 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #378caf8341845a95 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/render_search_template.js:76 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #60d7dd3db6f0b651 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:138 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3fc661e0739562b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:185 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02fec87b403f65de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:232 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #20f826733e8ceec6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:270 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #83729344f5837cb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:320 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #14f388806407a86a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:370 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4af3b5ff8ad1a765 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:408 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #75ceaaf6acd9436c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/rollup.js:446 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8e12fe0b14ba3d1d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/scripts_painless_execute.js:63 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7049a811f8cd8334 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/scroll.js:70 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d82b3cdeb96c1b6e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search.js:160 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d7f73fd6824e4e67 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:149 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56eb80e19f123617 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:187 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df8549cb4f65d214 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:225 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #482d99092816808a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:272 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1fc21801e61ddf74 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:308 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3f21716c7325889a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:350 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #44bf56ef766ed68a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:391 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #473bf62759b12bc2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:429 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c029ffa808b18aff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:479 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #51430db46c782eae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_application.js:529 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #70304c6338493e99 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_mvt.js:96 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5f3c03ad99f7e95d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_shards.js:67 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8f07f2e26c7cde66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/search_template.js:93 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e8514e3828530153 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/searchable_snapshots.js:115 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d227672184d9cecb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/searchable_snapshots.js:162 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #721ab35201d20c78 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/searchable_snapshots.js:213 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b738e6e2ae7bce85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/searchable_snapshots.js:260 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5562276fcc4abc24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:716 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cf067c182848ec14 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:752 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c5478aaa1c6876dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:799 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #993153a2da543ec1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:846 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c15636e1985d7f91 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:893 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac1d42158ee83c23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:952 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cdf0bc90ddb7ace0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:990 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9547c619a33a6caa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1028 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cc368720f984f614 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1066 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc0a32502b39f5d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1104 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d9de75ad7062422 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1144 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #113d7e38495e7a9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1191 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be013ab1a80b14d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1239 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cdfce4eb8e47810e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1286 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #405b5e714f78f7ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1334 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c98614ff720c9b70 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1381 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #480baba97a41b5d2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1420 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d7e15ff7cdb0c0e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1458 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cf51633888d1fcdd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1496 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc19c23ef1707bdb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1536 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1f750ce49be971fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1574 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9f5a457426a14591 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1612 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64215c7b87a72e66 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1650 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a2246f741614c11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1688 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4883a226f3cba232 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1726 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #92b14c60e2bd5f1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1762 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cbd5451645beb6c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1798 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #94989a4929232ea2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1834 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98a46e3286b82411 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1870 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e37f842a823af67 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1922 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7de6ab111cdac5c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:1969 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #39b78b784a00d08c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2016 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8b4f5f46306ca7be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2068 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f3209d972784ef6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2107 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a7d192099a7f9d77 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2143 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5871b5eb531a08f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2179 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #524634ae269d3637 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2227 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #529a8f8aeac7871a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2274 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c2f358459e5036db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2310 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #200d581c4a11374a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2348 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #46022742f7ea15c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2395 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9cad5e468f6ed611 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2454 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ddbc325b4a818932 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2501 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7d8495f93271f144 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2549 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #efb6d1c737792271 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2597 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4eb9ab80904eb6fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2644 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6563413ea05a0939 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2691 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37a8ebd5ea919b2d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2739 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #207163ce16f002a7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2777 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f93df4d6d1035729 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2827 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #712c61417548b7ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2877 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #38c4bcfecfed2705 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2927 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #91c945f5948b1b5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:2975 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #827d3596222a983e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3023 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4e199dbaac29ecba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3071 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cde606e70993a6a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3118 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9a067ae00a145314 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3165 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #93f013e095998270 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3212 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e76464ab9bd684f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3259 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a6e138b30d862105 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3307 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9f304b1b9530e257 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3345 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f8f111f6d816dffe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3393 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #28b2e595591d8d90 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3443 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f1cab63b552521b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3493 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a12e6fe044212a2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3541 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2ed4f8f0161ac5f1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/security.js:3591 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #411b1d7b8005c4c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/shutdown.js:96 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2eb1f64620467734 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/shutdown.js:143 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8e29beb1e6b2e400 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/shutdown.js:193 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #50a604df6abda029 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/simulate.js:98 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cffaf836554daaf6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:148 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de7ac2c464eb6c5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:186 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #15182e39f597bdcb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:222 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f87a044f051ec3a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:269 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #623ab0f84694d873 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:305 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56f6d12f65f55871 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:341 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b5976cc01807bcc8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:391 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f57b19d19e7a894f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:427 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c2a9dd340b18c334 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/slm.js:463 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c54732c34d2504e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:250 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5a250336044163f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:302 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e2b24d90b769546f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:353 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #12c97110dcfd65b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:394 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8b3c055e5ce46419 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:433 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a68cfc02609ec830 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:471 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2605e472e1b5fc7c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:510 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d2ea2ef7e93dc0e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:557 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cc16028fb37ab4a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:595 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad48cfa995aed43a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:633 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de216508c8bad20b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:684 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c467169afe800d20 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:736 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f34fd2dfc740428 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/snapshot.js:774 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f9b6d3c2b63e7af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/sql.js:140 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bbf1bea5dddef844 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/sql.js:178 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #09cdebfe7663f08d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/sql.js:216 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #51fadd51e898afc9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/sql.js:254 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c1d1cf3fcec59e3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/sql.js:302 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a570c644b0370ad7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/sql.js:349 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aeaead2b389007a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/ssl.js:64 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5b2bd15ca5e042af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/streams.js:88 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8d94e29b25c9599e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/streams.js:126 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d3c26d39eb0af700 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/streams.js:162 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5bad98551af5fea0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/synonyms.js:128 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #765dc97f0f035d99 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/synonyms.js:167 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2af68794c996250 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/synonyms.js:205 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f62f04ec33d50c64 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/synonyms.js:244 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bdbc3e185ebcbe83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/synonyms.js:280 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #94ba0847235b0a56 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/synonyms.js:330 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #879dedeeae6b0ea9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/synonyms.js:381 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0bb70d6190bda355 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/tasks.js:105 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c0ac5795bb0d003a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/tasks.js:143 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef8e3cf0c2e04ff7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/tasks.js:179 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #60b09804d1974a6d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/terms_enum.js:71 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ec984198d57f420 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/termvectors.js:98 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d7fe0e5426f5f9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/text_structure.js:134 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f49dfe6b3ffd36fb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/text_structure.js:181 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #694f3b837d1d8c23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/text_structure.js:219 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c827530917b48bc5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/text_structure.js:266 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ddd6e236a2c3fae8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:219 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #081dbbb164b7ea34 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:255 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7014619a56c9a6db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:302 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c24ffe84eea32b8c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:340 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b04f1d24d0505925 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:399 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0902cd77ec03d18a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:449 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d454cd26fea6abc1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:487 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c164f607b6c6fd10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:525 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8abff3d22b6650e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:561 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f6f8c9ec90571eb3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:599 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d03d31c92c7a4c89 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:637 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #53824b650418a349 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:687 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e4c244ae19ac0b96 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/transform.js:723 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #52528d14355c9c17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/update.js:87 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #24d38e399f727370 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/update_by_query.js:101 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5fcc889c6f771e84 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/update_by_query_rethrottle.js:52 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1017f9e7cfe8948c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:198 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8b5c80c2d90f8c62 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:236 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e10e112b5b8ec887 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:274 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e16d929ab226979 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:312 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #577622e7ff49225f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:371 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d576e7decc9bfbce — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:407 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #508d572c1a8ec851 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:445 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df0f64fb454a7f7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:495 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ace8ccb122e78131 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:543 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #263c138cdbd44c2d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:579 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7bf654307007236a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:626 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8d06bf5a316926cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:662 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0ca35e677e797b39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/watcher.js:710 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7d16190923acdb90 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/xpack.js:75 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #07fe91352db0a048 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/api/api/xpack.js:111 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f141c736a8cfd4ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/async_search.js:178 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b6a7b3265a7b87a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/async_search.js:216 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b704b7bcbb68173a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/async_search.js:254 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1009502a562ef5de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/async_search.js:318 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3dc1bf93423a1b5c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/autoscaling.js:102 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fff39aae03501e3a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/autoscaling.js:138 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ba811bb9a20c97c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/autoscaling.js:176 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #46f5f22605cdc530 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/autoscaling.js:217 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #04f15a9b6522c538 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/bulk.js:88 
    return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d930a4cc22402d69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cancel_reindex.js:55 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #010eea587bb395ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/capabilities.js:56 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3bc6c621f2dca266 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:385 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f95c2af8f41f3e9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:432 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c0be9fc6a1074668 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:479 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #781199f7a5127c65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:526 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #732e7de2bc65ba80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:585 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be10bfabe412eff6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:632 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37449168471eabe9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:668 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0ffd94f3173097f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:704 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b46f0b1c3bf36d07 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:751 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b59d997300fe7e9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:787 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec8e5f87529d6049 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:834 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02a53f29ab478058 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:881 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dfebe595fda67547 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:928 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #299e9ec023d18f4f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:975 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2a5600ffed8ac78 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1011 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #22ae6cb66a254114 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1047 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3cc62aafdc54021f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1083 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #591219587f189b6c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1119 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1ec25d34855b0352 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1166 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cd42ea2bd6662ca5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1202 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9505624f317875eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1249 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #041a5f115b2b3124 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1296 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8a896194d492cda5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1343 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2cc497da0cf4cb1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1379 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d2675044c47249d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1426 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #24bee11896000364 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1473 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #32493743781c4c64 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cat.js:1520 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6dec7b53fd3dd18e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:228 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #086c6198110e1c5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:278 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a64afd49eff38b86 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:316 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1c3fd566ab9dbcd7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:354 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a4f637343ae103c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:404 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bc55f5f4460892dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:451 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #75f6c9880f373746 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:489 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #039b146311776f39 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:527 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98b688007f78032e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:577 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d131c2367ea6e15f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:615 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #368b3184acd6cf0e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:665 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2a1db21a67e3112 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:701 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #34dd58748572fb17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ccr.js:739 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #313ef5039ee3bb2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/clear_scroll.js:69 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #185b30c972eb5dd2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/close_point_in_time.js:63 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3b90e5d30dd8c96f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:261 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e40a36cc98e416a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:299 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f007c7af2894fc6b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:335 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98d029dc09cbeb64 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:373 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #91b7454253fc5a21 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:420 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21db9b8ff1aa2e91 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:456 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #292b5de9ce00a345 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:503 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #266c913d46d290a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:541 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d094718129d19a53 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:577 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0565201c8638a977 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:613 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a69a8572c8c2a5ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:663 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1612ce9e2ccef010 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:711 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #94e20bb848271f83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:747 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #447416dd3f307ce1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:795 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #badee6c29cab69ca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:847 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d08b6ed27ebbc456 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/cluster.js:894 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #247d5f5ea8241860 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:389 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98cff01dd09c70d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:427 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bcdc6d3df6a11512 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:465 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #77745264e2bc3f00 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:515 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca65a63f2f4bb386 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:551 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c8c7483430ecaf5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:599 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0cb9ddcec8ce8945 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:658 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4e3b278aa93a5f44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:696 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2ae9374db893fd4b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:734 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42953ef44900c663 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:782 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a661aef97a4080d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:832 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7e66fd51c1ad1045 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:870 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7e3be2f0ee84a85b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:908 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0fcef6911e97db50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:958 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56ae47dd011dc701 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:996 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fea223c5f8db42f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1046 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7654e3d8ebe55f55 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1084 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5d29ce6a90453aab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1120 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #348b86df3c7458b1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1167 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6be5796500ced986 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1217 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7f6ffcd6612f3065 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1255 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #72b589dd118ecd6e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1305 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f4a9c4c711b4a6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1355 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6d78b8b4d1346506 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1405 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #771ce05f9155aba9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1455 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #577799189a250eff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1505 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #df2bf0074e9c61c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1555 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #06507fc3b797d909 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1605 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3526b343a0ae4e30 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1655 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #da4e517174901d1c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1705 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ba645ad11ad0be5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1755 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #894f59182b9506b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1805 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1f50668d2dd9eca4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1855 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0caa2addb0ccb63c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/connector.js:1905 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2ae281aa773e50f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/count.js:93 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2baa2bf622744a2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/create.js:72 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3ad3f1327895bef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/dangling_indices.js:90 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #851ff088f837f766 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/dangling_indices.js:128 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c7878f99d15f65ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/dangling_indices.js:164 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #751edbf6bfccb86e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/delete.js:64 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #65f16a02ea976930 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/delete_by_query.js:101 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5e0906602a21c6d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/delete_by_query_rethrottle.js:55 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a0d93df9a3f3568 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/delete_script.js:56 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7893e4d825278fee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/enrich.js:112 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9a7bb1546843bcd8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/enrich.js:150 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e39eb085ecf94d3e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/enrich.js:197 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f99bc6c5197db771 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/enrich.js:247 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #59b69f9e28d16148 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/enrich.js:283 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1785b62fce9c20d2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/eql.js:124 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f0bd85c51f620dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/eql.js:162 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #31aa40ff0a8b4b44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/eql.js:200 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b810fc7d0aa06444 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/eql.js:250 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #527a742aee85c343 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:183 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c4ea48705db3ca21 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:221 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a152ab41a4a99a9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:259 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #69c94446c3e40b9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:297 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21de6f4d80e50f03 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:335 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b351c0b334ed021f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:373 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3e741d8ec410bf44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:420 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a57bc7c510c11330 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:456 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3da39eceb3ecb305 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:506 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c29f75ef1d0f19ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/esql.js:553 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8a9767a4b37d0905 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/exists.js:66 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4c734725f13f7cb8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/exists_source.js:65 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #761ba53c0e4c319c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/explain.js:83 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aa006f35e4601178 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/features.js:75 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #634336078eafddf2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/features.js:111 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a77fdd1adfaf6cb9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/field_caps.js:89 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #555afe097c05f7cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/fleet.js:204 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e35790627815bbfd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/fleet.js:242 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4268ee620cc89016 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/fleet.js:280 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d8de3bb80d7b5623 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/fleet.js:329 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5f40df9783ef651 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/fleet.js:376 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6671712136643884 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/fleet.js:426 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6524f7210cfd0c18 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/get.js:68 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ae5f8a9d160c31c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/get_reindex.js:56 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b5f3fb241304063a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/get_script.js:55 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #81fcbbeb78c5175e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/get_script_context.js:49 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98132e6701604d34 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/get_script_languages.js:49 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a66b64b3b2ffb48 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/get_source.js:65 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #58f678d18d24a43c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/graph.js:91 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #529234c8910540b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/health_report.js:66 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #40196527e22ef39a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:163 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #775534619a0d7bbe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:201 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #91ad37ffa45f6b4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:248 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2fea39c7f48c006b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:284 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #35a2ce00fb8e3f1d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:332 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5a61c582ea95d618 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:382 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #67c9488510fdd458 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:432 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #615aaa84382f1f22 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:470 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a0fe64a4442f0d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:508 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #49c464f0000752ed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:544 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7c941238492c2157 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ilm.js:580 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #48cfea9d8dc45cad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/index.js:83 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5a85b20ee113565 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:989 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1febfdcdcfc8d084 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1048 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #27b1c1dd1544bcb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1086 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #502d8d06cd352b5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1133 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2306575a0c6c3901 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1184 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e49cddf37a7811f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1222 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b2122caf05eeca48 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1272 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #48261dd6b0d9f145 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1310 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dbc6e0181b7a0b62 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1352 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3606d783f0e0051 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1399 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f1767d67c7156828 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1437 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5860ed1121570779 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1484 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #433f5d0d9c626676 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1522 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca35fa08fb222a8f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1560 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #19c22fa582067b61 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1598 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8c34d77ffc25af06 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1636 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2dc6ea99d99cf89d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1674 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #08e39c80ee75b960 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1712 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #237d89bdcb25c18a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1754 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e26c5c1f3014f45f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1792 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37bf339925aca1e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1839 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #33e9e763e334384d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1877 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3f3fc6201d153524 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1915 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1c12ff828af3c980 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1953 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8736db2e55ce01b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:1991 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #94aa4e06c5756a19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2038 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3e2ecea88898aa71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2085 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7da9625ed35135d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2123 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8eda667773ab7534 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2179 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #909124fba1d709f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2217 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #60e313e127317f80 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2253 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #62c5dfb5fa8895bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2300 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #854c6fa0dc5f6651 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2338 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f52f13968cb5cce5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2376 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #36ed544f9e08b20a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2414 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f4bef32a913a003f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2461 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b0937905443e72da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2508 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d5efb5865f0130a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2555 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #93ab931ecfad71d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2593 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7483c3ca5765e8b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2649 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6c8896a39cd9f68b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2696 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #80d68ce2f00beb23 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2734 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2aa59d070eb92b81 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2772 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #87b98ecd44a0430e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2819 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #358ebcc897622990 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2857 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f8c0539b5005d4b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2895 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e8b3cb180f92cf64 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:2954 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b44ae781477c29af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3004 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b894af07516bcabf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3045 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5929a34cab77bb3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3095 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e0116a48af4ea181 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3136 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #94f6eb9e908b2a1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3186 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3afb3e4f1c8d743b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3236 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #580e32c9f85b0b8c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3285 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #465d67545e6f61e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3335 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #deccb5d049fff73a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3382 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7e93206c99e1e124 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3429 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #45e0d45e39b03345 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3467 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #408977392f1deaf5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3506 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #38b1a55c2d6f1ff4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3553 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #23857578a621164a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3603 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #34c0efd10c315352 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3662 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #66238b09157e2aad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3709 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e78166b58cf053ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3756 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #46b057a735838434 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3807 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f480d8daf11952c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3848 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b90c1c00ab5c03b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3907 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ab88a1df5c81bcb5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:3958 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ce43c6666fe0f16d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:4014 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac6e039f4e06e483 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:4062 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1249ba07b102c155 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/indices.js:4121 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #164e2efd601ffef9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:584 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5cb3e76e8c05c802 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:634 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #71732ad114cdc24d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:681 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #daff853567bff220 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:722 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a4e7f46e79d7114 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:778 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #053b562fd1992a22 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:837 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #438ee6697e3fda71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:887 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #461108fcd00d7c8c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:938 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7109167e0de7cc9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:989 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3f37ebeb0c3b8ac0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1040 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a51d6435ed37c4a4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1091 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #278dd532ae7f9d90 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1142 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #500c37cd138fc0fc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1193 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a217e622759f3628 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1244 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #57cd1e82c880922d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1295 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1e6597d8a61da129 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1346 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d42a649e42e1b1bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1397 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fd6c56da7af7472f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1448 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f502787b0378d828 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1499 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4d99001ed96fd7ce — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1550 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #60cfd079fdd33a5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1601 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de6247d63b6ae5f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1652 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #655bbfc96d0dde0e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1703 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4eb3fbb0fb08e1c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1754 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be3ae015fa644767 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1805 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c9e3384899490b8b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1856 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #30a2245c82232695 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1907 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e4670fdc7fdf7522 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:1958 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7a208e9e5eab43e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2009 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b77e7345ae720dc8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2060 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f44aeb558a53943c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2111 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c00f8a3579d79ba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2162 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1ebb0ed0248682b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2213 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9582afa60789d210 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2263 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec3bab17b94da7fa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2313 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0edacb3ac9684d83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2363 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #39b6f4460bf34c74 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2413 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4bb79217d3c1d391 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/inference.js:2463 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a9ab8fc8fbabdf0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/info.js:49 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3ee1d7bff4166e48 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:184 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2c3948a38de81cee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:222 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #52476d29bec70c81 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:260 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8c427d2786ba685b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:296 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7841117eda17881f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:343 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #72581a6f9bebc48c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:390 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #af722108c4909f7f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:437 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42b8f0ec6182062c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:473 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b49c163ac23c1a2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:523 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #47ed93a2f3516409 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:564 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #014a0edbce26cabe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:614 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8fea70c34d56ccf1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ingest.js:672 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1dd10f039c6e6af7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/knn_search.js:75 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #993990ca768a6433 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/license.js:118 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9537cb515b26b1da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/license.js:154 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1af9623c77625d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/license.js:190 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5c9bf78f8ab016d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/license.js:226 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6906f5b8f521686e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/license.js:274 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e20f8824a34a4b9e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/license.js:310 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cebaa3a0b230cd03 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/license.js:346 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8735d8cb41a78bec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/list_reindex.js:51 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8981c8f3eca81d65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/logstash.js:87 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b3dcf74e7d2002e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/logstash.js:134 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef92e3727a8d2d2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/logstash.js:175 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b14cace1fadeeced — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/mget.js:88 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3b305bd5504dee72 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/migration.js:89 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #798aeb5ffad87778 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/migration.js:125 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a4c6397414b4bb7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/migration.js:161 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f3b484e7bb36777 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1013 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7d31ced86f0995f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1063 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b275f390da185298 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1101 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb521ec027271f2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1140 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4080494397526fa8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1179 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d59e754ed351362 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1217 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bc76838492d1638f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1255 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f15d12ba632b9a28 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1314 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #23c8377337852e27 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1352 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f13a145cc9ba409 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1399 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a4eeca6d72dec543 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1437 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b54469a93b5d86c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1476 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #921ba48323b53b95 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1514 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a6eacc3d3ef30978 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1553 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1cef86869554354 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1601 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a0b572165c300a4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1648 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2adc55e11c32eacd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1707 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #27cf2382fb845d60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1757 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #afe84aa27e4bf569 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1807 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6dc6aa174051a57a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1866 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #84b3631f76da8821 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1904 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c0be0e4be4941978 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:1963 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ae1a1ffbaf00051 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2022 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b30f9ffab2ab33ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2069 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5b13f9eaecdb4db0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2116 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e8961179d5adf68c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2163 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #836a8fc7d5c47249 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2210 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac3a707bf0176f50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2257 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e2b4c4d3e7f4783 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2307 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5f7c8b6b6226e765 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2354 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a08d8205f072295b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2401 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ca331c7de84bda4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2448 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5e1167d4f254e91c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2487 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #592fea3455ec934c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2546 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef86bc0b0d29e7aa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2596 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #61eca17b8eb0374b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2646 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #83b242ad09254770 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2693 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #97e6dd667688072a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2740 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #363fb2caa66d9c18 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2790 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #99db4c452ee3bb52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2826 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #40283e9068e69889 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2876 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b391cac7af90634f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2926 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d05a71cc669444b2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:2967 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #36267ac5a481f7af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3026 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #65df0c609597fd4d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3085 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c7465fd9de06ac7c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3135 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ce7391e8b61cc617 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3174 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #29bf0cce6fa599b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3224 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #669a6fa07f491256 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3274 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d624868fa6ed3886 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3324 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4648806a26bb9bd6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3374 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4bfc1393e501fd43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3424 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #124d9c8c2e1efb0d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3463 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b8add2c08385ecd3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3514 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #71497783ffc038c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3564 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5099aed48c83f1ed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3602 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d20612136386cffd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3653 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #604c72c7173da246 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3689 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa7862858c85f7b5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3739 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7cd67fd7444475ba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3789 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7a44d47e9c560af5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3839 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a9adbaed611943df — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3889 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d825cf54035668cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3939 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bdab88270c4a40c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:3989 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1a2ae3259be8fc52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4039 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c1c06251394e9ca8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4089 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #19fca2f8dddc3171 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4139 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ff6f3c506ff333f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4189 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #57366ae542ff71a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4240 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f4b5f64bd2576d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4290 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9e4e2d94542510c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4329 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5a89b87bcb8114f7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4377 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b93ba58381c87b18 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ml.js:4415 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e9b8fd2c960e72e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/monitoring.js:75 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ada52394ea624ff2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/msearch.js:83 
    return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cb24f21c4461bb7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/msearch_template.js:74 
    return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ab802729b99d2ae2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/mtermvectors.js:91 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1f021e134acf9675 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/nodes.js:146 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5013fefce5c8a8b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/nodes.js:184 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #82eccd948dbb9ff7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/nodes.js:231 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e7b2bfced861ab75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/nodes.js:287 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #04672e9c1b0e2ea5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/nodes.js:346 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5f1b4a2e004b66c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/nodes.js:411 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a073b8a5ddff2bba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/nodes.js:467 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fed55f64295d2bc0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/open_point_in_time.js:77 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fd4152286b9b8a29 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ping.js:49 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #694f15f4883c7cd2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/profiling.js:94 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6938fbdc2734aa11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/profiling.js:132 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c1c99a458516b7a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/profiling.js:168 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e7b1617074fc7c65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/profiling.js:206 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #83e87c17f419a5ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/project.js:106 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4fed69546e31e1be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/project.js:147 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1cb49a175a5e8b25 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/project.js:185 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #25c06d80cb056981 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/project.js:221 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d8e6d77c735dda55 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/project.js:259 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #49f7727134620ddb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/project.js:307 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d5429866532a450c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/put_script.js:82 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #438a08781dd5ea32 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:134 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #14fbed1125128a47 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:172 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #523cb3ed1aeb6321 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:211 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a01e27c26491b909 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:249 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2e5dc6558bc8bac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:285 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #74c62f42d3bdecf3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:336 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ee6887b40279f0f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:386 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7bfd787b7b113160 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/query_rules.js:436 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ea251570d46a3328 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rank_eval.js:82 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #54819004a0892ace — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/reindex.js:77 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3e8818ee017a2dd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/reindex_rethrottle.js:56 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c71c3364cc691485 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/render_search_template.js:79 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #77abce88ab632d4e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:140 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7a08abcc83c71bdf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:187 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f6a242e464b2c1b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:234 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4bf9f9336504d468 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:272 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a10508cee787e9cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:322 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad8d212d998e3acd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:372 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0310a8c5c5b74697 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:410 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9844366f3d9840d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/rollup.js:448 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64edb17e56091ce8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/scripts_painless_execute.js:66 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #390e2de01d9c0971 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/scroll.js:73 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cdc051737a8a213b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search.js:163 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #342718666e31ced6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:151 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #924007ce4a77455c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:189 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #40103829c436037e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:227 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #67ab796ac795d88e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:274 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f58d3c2e53c0533 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:310 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #15669deafcd56557 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:352 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42051f85315e4813 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:393 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d780c76b031adb70 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:431 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef6e6a9815b80437 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:481 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #66eed21ed9e7c20d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_application.js:531 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5c7339212264f593 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_mvt.js:99 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #773d2ae96f5f7d31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_shards.js:70 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1f4b04e8ec5df891 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/search_template.js:96 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2983a8843bda60d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/searchable_snapshots.js:117 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3a6bf13ef1ce5880 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/searchable_snapshots.js:164 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7cb2830769955924 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/searchable_snapshots.js:215 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #09a887d5a2e53aa4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/searchable_snapshots.js:262 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ff5d5738ce501dd1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:718 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de540136d8d47bba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:754 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ed8e364eca572115 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:801 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4470cfa4711bd4b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:848 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #93cc46d2d4ab1f21 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:895 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b3d45693b689082c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:954 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b9d59e3994b32c1d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:992 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5144368d1c9d52e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1030 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #61dcbcace32bfff5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1068 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2c66d01c9d0058d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1106 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #740cef7629e2a03f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1146 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #62e98ce73af68750 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1193 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e71ebfa74a0346cf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1241 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #30d306c3a94eee09 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1288 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #028a43ef7d52ee8b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1336 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c9b841250ac79766 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1383 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #16837d466b18179d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1422 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a449830fb29a983 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1460 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2bd27f863b076669 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1498 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #63617519e107218e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1538 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #64ae8db0f59ebbfe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1576 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be1456a0d5c7ac52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1614 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4d8d272c576acd3b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1652 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a972a41b084ab2d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1690 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6174761272f18dc6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1728 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8e376d4189d3eecc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1764 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a23cff67b21abcbd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1800 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6274b4513e24fe8f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1836 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9cbb62a96c63bec2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1872 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #68a8a886b015a927 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1924 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d81cc0b78ded0d2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:1971 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a30b8117f4fa9e0a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2018 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f0a570b9a33b65d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2070 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37e8b66109367205 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2109 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3dcf24d303389eb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2145 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #004ec84fbe4d3d42 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2181 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e99b0914305602fe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2229 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de6353ac83b701f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2276 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #632c5c3d81359106 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2312 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b20f874d6cc306de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2350 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d7fc6c0aba7c88dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2397 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c59b4fb523b89eb1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2456 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #49e14eedd977c6bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2503 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a524b8909cde9c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2551 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e6ab09d5d9e79dc9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2599 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c943f08e72f6561c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2646 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a1ca3bbb14dbdcff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2693 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #52e71f4e68b9b876 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2741 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4139a7544f30ffb0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2779 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2875bd3e7d22a7c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2829 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eae5eaef1ceb6d88 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2879 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ae82b9f513c751b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2929 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #271a61bb2ab5d215 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:2977 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c437f2ce45e6badb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3025 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #da3d59001811b633 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3073 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #29ced6c76063bcca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3120 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #607b765c11390897 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3167 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f9dac792bedcea90 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3214 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c373356aa2ed837f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3261 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d7c4f96f58c17fa8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3309 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #74d1ae794302638e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3347 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dd79bbceb5683eed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3395 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c6238a3660b61bd7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3445 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ee42cdd3c382c514 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3495 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #06d26b247753de51 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3543 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f7e1d156dccefe3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/security.js:3593 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7261eda881372f44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/shutdown.js:98 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6552a67891910e46 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/shutdown.js:145 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d0e19f14d3bb91c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/shutdown.js:195 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #078e34cdc5d487dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/simulate.js:100 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eeda7ec17d9903bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:150 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bbf361631bf02f4e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:188 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f2e9299b7bee3e5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:224 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b70589880634d5e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:271 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4357b39765b66337 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:307 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0150c69b8f648f83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:343 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bc4f76fa4ee7de6a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:393 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #17c53ea0c49efbd4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:429 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #68c9addbb96bdaab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/slm.js:465 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c08d7f06f6b24eac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:252 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f986c39d98836722 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:304 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5ba3c3b819d791a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:355 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8765de5da891fa96 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:396 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b82ba55729304a1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:435 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #80456bf6c3856dfa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:473 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f875345b748ecda — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:512 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c358087e23a20ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:559 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3652ed6646bdebb2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:597 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #59c284c644275437 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:635 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #759e41176055761c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:686 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c318eec3a71ed8ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:738 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #62f081678c4e2f85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/snapshot.js:776 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be803957ec14b54f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/sql.js:142 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #75fda78dd81471e1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/sql.js:180 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f1c98ac8512764d9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/sql.js:218 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6b7f97d980e461f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/sql.js:256 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f7ae065a7e3d8ce8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/sql.js:304 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #65b05b92d1399e9e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/sql.js:351 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b55dc286f0a95b60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/ssl.js:66 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ff94d180d0ac6d98 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/streams.js:90 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #adc05b56c8dd3257 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/streams.js:128 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21e9f30e19ec4bf4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/streams.js:164 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bcb949920603fcdb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/synonyms.js:130 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #82869c24c89624e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/synonyms.js:169 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #57acb3bf2a18f3f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/synonyms.js:207 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fef9d33a39f05a85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/synonyms.js:246 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f184e2307b0abd7c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/synonyms.js:282 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #18acc50ef627a4fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/synonyms.js:332 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b774253c31b7581 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/synonyms.js:383 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #48bfdbebcbe24d19 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/tasks.js:107 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2d95eb36f8387edb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/tasks.js:145 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8ce741cd78bd968c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/tasks.js:181 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fe55af99e63324db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/terms_enum.js:74 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ae6fed4a6242ab6b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/termvectors.js:101 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6d2241482c032082 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/text_structure.js:136 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #880213c05f37d663 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/text_structure.js:183 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aa3170097d3fe25f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/text_structure.js:221 
        return await this.transport.request({ path, method, querystring, bulkBody: body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #76c6abda374c011d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/text_structure.js:268 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fad2d569fdcff55d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:221 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #885f126efd575807 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:257 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fd663d6d9bb62bde — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:304 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8d58f40323fa601a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:342 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d8fbbb7f77a9522a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:401 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #339b0f2a5567bf5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:451 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2814f5a7b41c3654 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:489 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #81111ed5abc14849 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:527 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa22ab231a22bc61 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:563 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9f946d96a3ccd23c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:601 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13fad406c37d8e0c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:639 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #368b0ae33fd40dd6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:689 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6ce27ef48700d63a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/transform.js:725 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #67863c6e6a67d487 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/update.js:90 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cf586d762e15b793 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/update_by_query.js:104 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e77c46fd965a0f46 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/update_by_query_rethrottle.js:55 
    return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #423e3e756cd13b78 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:200 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #65add5ed3a2a5e99 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:238 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d99b10d92c673798 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:276 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1709d3e9ee80e587 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:314 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7713aeaea8ce0cda — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:373 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b0be120a1746eb1e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:409 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fe306c0826daf2f1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:447 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #307bf4bb02f76f8b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:497 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d24e182e7bb3ead — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:545 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9a3f860db39bbb17 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:581 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #077749b28bc1cf77 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:628 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bf34a77c51b32fa8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:664 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #70b801c07e37d1b9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/watcher.js:712 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad94c6b99583f072 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/xpack.js:77 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4c021c14f34d9d4c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/api/api/xpack.js:113 
        return await this.transport.request({ path, method, querystring, body, meta }, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@elevenlabs/elevenlabs-js

npm dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #431ff93a14233303 — Filesystem access.
pkgs/npm/@[email protected]/core/file/file.js:87 
            const fs = yield Promise.resolve().then(() => __importStar(require("fs")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9f85f5bd6380634 — Filesystem access.
pkgs/npm/@[email protected]/core/file/file.js:130 
            const fs = yield Promise.resolve().then(() => __importStar(require("fs")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #334b8f041180a902 — Filesystem access.
pkgs/npm/@[email protected]/scripts/rename-to-esm-files.js:3 
const fs = require("fs").promises;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5a816c5220d90291 — Filesystem access.
pkgs/npm/@[email protected]/scripts/rename-to-esm-files.js:48 
    const content = await fs.readFile(file, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #25b43f2168ae77f9 — Filesystem access.
pkgs/npm/@[email protected]/scripts/rename-to-esm-files.js:66 
        await fs.writeFile(file, newContent, "utf8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #faa8d5050e54a59a — Environment-variable access.
pkgs/npm/@[email protected]/wrapper/ElevenLabsClient.js:46 
        const apiKey = (_a = options.apiKey) !== null && _a !== void 0 ? _a : process.env.ELEVENLABS_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #902f4da4bfc593f7 — Environment-variable access.
pkgs/npm/@[email protected]/wrapper/speech-engine/SpeechEngineServer.js:47 
        const apiKey = (_b = this.options.apiKey) !== null && _b !== void 0 ? _b : process.env.ELEVENLABS_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@modelcontextprotocol/sdk

npm dependency
expand_more 38 low-confidence finding(s)
low egress tooling Excluded from app score unknown #777a0cd658e5032b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/scripts/cli.ts:54 
    await client.request({ method: 'resources/list' }, ListResourcesResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #3a1ae197920854ee — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:16 
    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #a36d466933ebb715 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:32 
    const response = await fetch(url);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #3b48081e062fb3eb — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/fetch-spec-types.ts:77 
        writeFileSync(outputPath, fullContent, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4771972b57d28fb2 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/client/stdio.ts:71 
        const value = process.env[key];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #e8227175ecc78a82 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:632 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #f65a648f188eec13 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/elicitationUrlExample.ts:663 
        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #3407f848631d468d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/multipleClientsParallel.ts:64 
        const result = await client.request(toolRequest, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #c8d6d44b2b38dee3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:95 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #4ea4206585a70177 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/parallelToolCallsClient.ts:167 
            return client
                .request(request, CallToolResultSchema)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #74a4798e9f8aeab4 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:26 
const DEFAULT_SERVER_URL = process.env.MCP_SERVER_URL || 'http://localhost:3000/mcp';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #20a4769d16dad631 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:29 
    const clientId = process.env.MCP_CLIENT_ID;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fb9a3bef27d32816 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:36 
    const privateKeyPem = process.env.MCP_CLIENT_PRIVATE_KEY_PEM;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #32ed80760e1024a8 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:38 
        const algorithm = process.env.MCP_CLIENT_ALGORITHM || 'RS256';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #879765148e553016 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleClientCredentials.ts:48 
    const clientSecret = process.env.MCP_CLIENT_SECRET;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #8689e8c8dbe25988 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:232 
            const result = await this.client.request(request, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #250363abecbe0428 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleOAuthClient.ts:290 
            const result = await this.client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #c25971ec3dcc1b6b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:510 
                const resourcesResult = await client.request(
                    {
                        method: 'resources/list',
                        params: {}
                    },
                    ListResourcesResultSchema
                );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #0be476625f75c3bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:601 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #0adb717225174331 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:632 
        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #b92a2ca4c21eaa9b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:719 
        const result = await client.request(request, CallToolResultSchema, {
            resumptionToken: notificationsToolLastEventId,
            onresumptiontoken: onLastEventIdUpdate
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #7542240fc4e32f7c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:748 
        const promptsResult = await client.request(promptsRequest, ListPromptsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #c8d3cd2da1899ba4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:777 
        const promptResult = await client.request(promptRequest, GetPromptResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #7ad2fe124cfa76f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:798 
        const resourcesResult = await client.request(resourcesRequest, ListResourcesResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #ebb104e6e649fe8d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/simpleStreamableHttp.ts:826 
        const result = await client.request(request, ReadResourceResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #25a73efacadf835f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/ssePollingClient.ts:75 
        const result = await client.request(
            {
                method: 'tools/call',
                params: {
                    name: 'long-task',
                    arguments: {}
                }
            },
            CallToolResultSchema,
            {
                // Track resumption tokens for debugging
                onresumptiontoken: token => {
                    lastEventId = token;
                    console.log(`[Event ID] ${token}`);
                }
            }
        );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #be96e8f003d494d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:139 
        const toolsResult = await client.request(toolsRequest, ListToolsResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #dcaa86959e5ec86c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/client/streamableHttpWithSseFallbackClient.ts:172 
        const result = await client.request(request, CallToolResultSchema);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #2b64ba20cf47b88a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationFormExample.ts:350 
    const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #212af848e3475ce0 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:215 
const MCP_PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #af36b2bc707e3032 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:216 
const AUTH_PORT = process.env.MCP_AUTH_PORT ? parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #151bfff0000a932b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/server/elicitationUrlExample.ts:245 
        const response = await fetch(endpoint, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/x-www-form-urlencoded'
            },
            body: new URLSearchParams({
                token: token
            }).toString()
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #3f82d018c431a2ed — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/honoWebStandardStreamableHttp.ts:69 
const PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5079b84f6d019ccb — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:621 
const MCP_PORT = process.env.MCP_PORT ? parseInt(process.env.MCP_PORT, 10) : 3000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d98c347ce28c3b8b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:622 
const AUTH_PORT = process.env.MCP_AUTH_PORT ? parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #a74e96c0f6c1b54c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleStreamableHttp.ts:643 
            const response = await fetch(endpoint, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/x-www-form-urlencoded'
                },
                body: new URLSearchParams({
                    token: token
                }).toString()
            });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #07f6e5b9fc296f8a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/examples/server/simpleTaskInteractive.ts:448 
const PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : 8000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e7075173ea04d979 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/src/server/auth/router.ts:12 
    process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === 'true' || process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === '1';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@oclif/core

npm dependency
expand_more 20 low-confidence finding(s)
low env_fs dependency Excluded from app score #f24ce3645a9fe105 — Environment-variable access.
pkgs/npm/@[email protected]/lib/command.js:323 
        keys.map((key) => delete process.env[key]);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac4489c807a62cea — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/config.js:201 
        const base = process.env[`XDG_${category.toUpperCase()}_HOME`] ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4e303e7d6882bece — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/config.js:202 
            (this.windows && process.env.LOCALAPPDATA) ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #88a20f1a37174a57 — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/config.js:310 
        this.home = process.env.HOME || (this.windows && this.windowsHome()) || (0, os_1.getHomeDir)() || (0, node_os_1.tmpdir)();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #00f18f7f0c2fe2d4 — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/config.js:548 
        return process.env[this.scopedEnvVarKeys(k).find((k) => process.env[k])];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d9fef342ad76d3b — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/config.js:579 
        return process.env.HOMEDRIVE && process.env.HOMEPATH && (0, node_path_1.join)(process.env.HOMEDRIVE, process.env.HOMEPATH);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #edeeaf0ac9562535 — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/config.js:582 
        return process.env.USERPROFILE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7c6dbcc4c3d760ea — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/config.js:587 
        const SHELL = process.env.SHELL ?? (0, node_os_1.userInfo)().shell?.split(node_path_1.sep)?.pop();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd5d42a0d42bbb0f — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/plugin.js:222 
                if (!process.env.OCLIF_NEXT_VERSION && manifest.version.split('-')[0] !== this.version.split('-')[0]) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7eff4e7e68c9a5a6 — Environment-variable access.
pkgs/npm/@[email protected]/lib/config/ts-path.js:266 
        debug(`Skipping typescript path lookup for ${root} because it's an ESM module (NODE_ENV: ${process.env.NODE_ENV}, root plugin module type: ${rootPlugin?.moduleType})`);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f4140c0ee2d49f4 — Environment-variable access.
pkgs/npm/@[email protected]/lib/execute.js:55 
        process.env.NODE_ENV = 'development';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #42c904cd14338708 — Environment-variable access.
pkgs/npm/@[email protected]/lib/parser/parse.js:16 
        process.env.CLI_FLAGS_DEBUG === '1'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #666db2999520afdd — Environment-variable access.
pkgs/npm/@[email protected]/lib/parser/parse.js:337 
            if (fws.inputFlag.flag.env && process.env[fws.inputFlag.flag.env]) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d7002ecd0ba224d2 — Environment-variable access.
pkgs/npm/@[email protected]/lib/parser/parse.js:338 
                const valueFromEnv = process.env[fws.inputFlag.flag.env];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f39466aba2127111 — Environment-variable access.
pkgs/npm/@[email protected]/lib/parser/parse.js:348 
                        valueFunction: async (i) => (0, util_1.isTruthy)(process.env[i.inputFlag.flag.env] ?? 'false'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f3e8ccda41babaf — Environment-variable access.
pkgs/npm/@[email protected]/lib/screen.js:18 
const columns = Number.parseInt(process.env.OCLIF_COLUMNS, 10) || settings_1.settings.columns;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d6791911e45c707 — Environment-variable access.
pkgs/npm/@[email protected]/lib/util/read-pjson.js:16 
    if (process.env.OCLIF_DISABLE_RC) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ab84d137e623236c — Environment-variable access.
pkgs/npm/@[email protected]/lib/util/util.js:58 
    return !['development', 'test'].includes(process.env.NODE_ENV ?? '');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ac467fcd8a7f4ad2 — Environment-variable access.
pkgs/npm/@[email protected]/lib/ux/index.js:29 
    !process.env.CI &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #938d711f1a94de10 — Environment-variable access.
pkgs/npm/@[email protected]/lib/ux/index.js:30 
    !['dumb', 'emacs-color'].includes(process.env.TERM) &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

bullmq

npm dependency
expand_more 10 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #b51b0039f61fca84 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/commandTransform.js:2 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #811a138feb2c90e8 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/generateRawScripts.ts:3 
import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a54d26018b429ccf — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/updateVersion.js:1 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c8aef3542ebcffd2 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/updateVersion.js:9 
fs.writeFileSync(versionFilePath, content, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #991a1569bb5af696 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/classes/child-processor.ts:13 
const RESPONSE_TIMEOUT = process.env.NODE_ENV === 'test' ? 500 : 5_000;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #9f91275d13c79863 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]__reposrc/src/classes/queue-getters.ts:110 
    return client.get(`${this.keys.de}:${id}`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79cd797fc308b6de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]__reposrc/src/classes/queue-getters.ts:121 
    return client.get(`${this.keys.de}:${id}`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #af2ec8d4ccb64a19 — Filesystem access.
pkgs/npm/[email protected]__reposrc/src/classes/worker.ts:1 
import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #70ca710ef25ac6af — Filesystem access.
pkgs/npm/[email protected]__reposrc/src/commands/script-loader.ts:3 
import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eb12580307360514 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/utils.ts:137 
  prefix = process.env.BULLMQ_TEST_PREFIX || 'bull',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

connect-pg-simple

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #e23206e844b2c0d2 — Environment-variable access.
pkgs/npm/[email protected]/index.js:137 
        const conString = options.conString || process.env['DATABASE_URL'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #868b2ffd19cd2d64 — Filesystem access.
pkgs/npm/[email protected]/index.js:183 
        const tableDefString = await fs.readFile(pathModule.resolve(__dirname, './table.sql'), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

connect-redis

npm dependency
expand_more 1 low-confidence finding(s)
low egress dependency Excluded from app score #0c3b37e4fb806085 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/index.ts:50 
      let data = await this.client.get(key)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

dotenv

npm dependency
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #aaf7b3a7195b3bb6 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:4 
if (process.env.DOTENV_CONFIG_ENCODING != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #261728465fc63557 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:5 
  options.encoding = process.env.DOTENV_CONFIG_ENCODING

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee7ced33208a6b4f — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:8 
if (process.env.DOTENV_CONFIG_PATH != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #68d073f9eacdd1e8 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:9 
  options.path = process.env.DOTENV_CONFIG_PATH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f86d212be7c5013d — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:12 
if (process.env.DOTENV_CONFIG_QUIET != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e565c665f969d27 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:13 
  options.quiet = process.env.DOTENV_CONFIG_QUIET

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6eb481a096831b58 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:16 
if (process.env.DOTENV_CONFIG_DEBUG != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d514254a5e89aac1 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:17 
  options.debug = process.env.DOTENV_CONFIG_DEBUG

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5dbec5dada018750 — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:20 
if (process.env.DOTENV_CONFIG_OVERRIDE != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b6eb9f52950c2cad — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:21 
  options.override = process.env.DOTENV_CONFIG_OVERRIDE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfa9f703eeb20bdc — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:24 
if (process.env.DOTENV_CONFIG_DOTENV_KEY != null) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f5601931e211fc8b — Environment-variable access.
pkgs/npm/[email protected]/lib/env-options.js:25 
  options.DOTENV_KEY = process.env.DOTENV_CONFIG_DOTENV_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b0f292f372b58c50 — Filesystem access.
pkgs/npm/[email protected]/lib/main.js:1 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a46ca0fbb37787a — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:141 
  if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f778893e9d268ea2 — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:142 
    return process.env.DOTENV_KEY

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #449d2d3bc453fc1d — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:221 
  const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || (options && options.debug))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56dfb0838cb11184 — Environment-variable access.
pkgs/npm/[email protected]/lib/main.js:222 
  const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || (options && options.quiet))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #61ae209df495e8b2 — Filesystem access.
pkgs/npm/[email protected]/lib/main.js:277 
      const parsed = DotenvModule.parse(fs.readFileSync(path, { encoding }))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

express

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #19d66881847ef965 — Environment-variable access.
pkgs/npm/[email protected]/lib/application.js:91 
  var env = process.env.NODE_ENV || 'development';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

express-mysql-session

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #5ee8c3a4962a9d20 — Filesystem access.
pkgs/npm/[email protected]/index.js:136 
			const fs = require('fs').promises;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39b61eec6be715bc — Filesystem access.
pkgs/npm/[email protected]/index.js:138 
			return fs.readFile(schemaFilePath, 'utf-8').then(sql => {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

express-session

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #7a698fff6a55bc98 — Environment-variable access.
pkgs/npm/[email protected]/index.js:33 
var env = process.env.NODE_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

flowise-nim-container-manager

npm dependency
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #e1c40324d722eb28 — Filesystem access.
pkgs/npm/[email protected]/src/NimContainerManager.js:9 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #129abe772c532ccc — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:15 
process.env.LLM_PROVIDER = "nvidia-nim";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #553ec04a9829cee6 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:16 
process.env.NVIDIA_NIM_LLM_MODE = "managed";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #838df44ea4337d95 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:49 
      process.env.LLM_PROVIDER === "nvidia-nim" &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3f6004e4263efe81 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:50 
      process.env.NVIDIA_NIM_LLM_MODE === "managed"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d23fd4389861315c — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:60 
        process.env.NVIDIA_NIM_LLM_MODE = "remote";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d076cae59dd1fdc — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:74 
      if (process.env.LLM_PROVIDER !== "nvidia-nim") return;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e0f20be0b9a2052b — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:75 
      if (process.env.NVIDIA_NIM_LLM_MODE !== "managed") return;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #4d39ff33500f1ea4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/NimContainerManager.js:490 
      const req = request(options, (res) => {
        let data = "";
        res.on("data", (chunk) => {
          data += chunk;
        });
        res.on("end", () => {
          try {
            resolve(JSON.parse(data));
          } catch (e) {
            resolve(data);
          }
        });
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #a8a464c2bc91bd2c — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:520 
      process.env.NODE_ENV === "development"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d46882c6a03dd7fe — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:588 
    if (process.env.NODE_ENV === "development" || !!process.env.NGC_PATCH)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eec99823658d74d8 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:629 
          ...(process.env.NODE_ENV === "development" || !!process.env.NGC_PATCH

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #766cce89851bea71 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:874 
    process.env.NVIDIA_NIM_LLM_NGC_API_KEY = newKey;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64727b94f046e209 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:929 
      process.env.NVIDIA_NIM_LLM_NGC_API_KEY = providedKey;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0048c7fea36d9c27 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:990 
    if (!!process.env.NVIDIA_NIM_LLM_NGC_API_KEY) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #122f4092e231d6c2 — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:992 
        `Using stored NGC API key: ${process.env.NVIDIA_NIM_LLM_NGC_API_KEY.slice(

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7679bce0ccdbb43d — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:995 
        )}...${process.env.NVIDIA_NIM_LLM_NGC_API_KEY.slice(-5)}`

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d71cd430c06b23c — Environment-variable access.
pkgs/npm/[email protected]/src/NimContainerManager.js:997 
      this.ngcApiKey = process.env.NVIDIA_NIM_LLM_NGC_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

flowise-ui

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #45f11d6a27a92349 — Environment-variable access.
pkgs/npm/[email protected]/vite.config.js:47 
            port: process.env.VITE_PORT ?? 8080,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3f34b41f0fdf1bbe — Environment-variable access.
pkgs/npm/[email protected]/vite.config.js:48 
            host: process.env.VITE_HOST

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

global-agent

npm dependency
expand_more 27 low-confidence finding(s)
low env_fs dependency Excluded from app score #fdec752405a1e02e — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/classes/Agent.ts:112 
    const rejectUnauthorized = process.env.NODE_TLS_REJECT_UNAUTHORIZED;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #99d2e61249c4dafd — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:62 
const defaultNodeTlsRejectUnauthorized = process.env.NODE_TLS_REJECT_UNAUTHORIZED;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c275a057441dcd79 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:136 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = defaultNodeTlsRejectUnauthorized;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #93ccb5dd381a92f6 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:343 
  process.env.GLOBAL_AGENT_FORCE_GLOBAL_AGENT = 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #31ca2ae656010474 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:359 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = 'null';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #82c328d0b4850ace — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:371 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = 1;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ee9c828d8858435d — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:385 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = 0;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8e0fecb7209b4ae2 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:399 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = true;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3639838ede5ca348 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:411 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = false;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #497e3b353f709f90 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:422 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = 'yes';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #535b6f6b0110b835 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:433 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = 'no';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a82da9c6f3b4e92c — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:461 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4d1183436588bdb4 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:480 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #bd0afe73d950abb4 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:499 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fa80042d328efb1f — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:518 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e82f2b103445bf3c — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:538 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b4c87e86be324e90 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:554 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #84068556d4dd9e76 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:586 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress tooling Excluded from app score unknown #60a1ed080fbf68a2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:625 
    http.get(httpServer.url, createHttpResponseResolver(resolve));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #3973ec1b13722734 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:646 
    http.get({
      path: '/endpoint',
      socketPath: '/tmp/test.sock',
    }, createHttpResponseResolver(resolve));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #e8cae56afeea2276 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:665 
    http.get({
      host: '127.0.0.1',
    }, createHttpResponseResolver(resolve));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #e30a8875a10e7c99 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:687 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1d193ba8b58bb4c4 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:713 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #38f330456770a3ee — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.test.ts:745 
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cf4c217c7faa844d — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.ts:70 
  proxyController.HTTP_PROXY = process.env[configuration.environmentVariableNamespace + 'HTTP_PROXY'] ?? null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f90f6cf3bf69ef6e — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.ts:73 
  proxyController.HTTPS_PROXY = process.env[configuration.environmentVariableNamespace + 'HTTPS_PROXY'] ?? null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26477dbb495c5470 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/factories/createGlobalProxyAgent.ts:76 
  proxyController.NO_PROXY = process.env[configuration.environmentVariableNamespace + 'NO_PROXY'] ?? null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

handlebars

npm dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #9a8f21d46cd22696 — Filesystem access.
pkgs/npm/[email protected]/lib/index.js:18 
  var fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6236f6796c434167 — Filesystem access.
pkgs/npm/[email protected]/lib/index.js:19 
  var templateString = fs.readFileSync(filename, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77bbca29cd292f6d — Filesystem access.
pkgs/npm/[email protected]/lib/precompiler.js:4 
import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6db593d5bfc86cd2 — Filesystem access.
pkgs/npm/[email protected]/lib/precompiler.js:113 
          fs.readFile(path, 'utf8', function(err, data) {
            /* istanbul ignore next : Race condition that being too lazy to test */
            if (err) {
              return callback(err);
            }

            if (opts.bom && data.indexOf('\uFEFF') === 0) {
              data = data.substring(1);
            }

            // Clean the template name
            let name = path;
            if (!root) {
              name = basename(name);
            } else if (name.indexOf(root) === 0) {
              name = name.substring(root.length + 1);
            }
            name = name.replace(extension, '');

            ret.push({
              path: path,
              name: name,
              source: data
            });

            callback();
          });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad4626904c706205 — Filesystem access.
pkgs/npm/[email protected]/lib/precompiler.js:301 
    fs.writeFileSync(opts.map, output.map, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f96262eacb5a7b23 — Filesystem access.
pkgs/npm/[email protected]/lib/precompiler.js:306 
    fs.writeFileSync(opts.output, output, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

multer

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #867ed02ff6f243fe — Filesystem access.
pkgs/npm/[email protected]/storage/disk.js:1 
var fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

multer-azure-blob-storage

npm dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #333b95748f76dcfb — Environment-variable access.
pkgs/npm/[email protected]/lib/MulterAzureStorage.js:69 
        options.connectionString = (options.connectionString || process.env.AZURE_STORAGE_CONNECTION_STRING || null);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d99806e3cc4feef3 — Environment-variable access.
pkgs/npm/[email protected]/lib/MulterAzureStorage.js:71 
            options.accessKey = (options.accessKey || process.env.AZURE_STORAGE_ACCESS_KEY || null);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #53fad65e4c846151 — Environment-variable access.
pkgs/npm/[email protected]/lib/MulterAzureStorage.js:72 
            options.accountName = (options.accountName || process.env.AZURE_STORAGE_ACCOUNT || null);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

multer-cloud-storage

npm dependency
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #9de52ed0720eefe4 — Environment-variable access.
pkgs/npm/[email protected]/lib/index.js:118 
        const bucket = opts.bucket || process.env.GCS_BUCKET || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #92cb262e0420ceb4 — Environment-variable access.
pkgs/npm/[email protected]/lib/index.js:119 
        const projectId = opts.projectId || process.env.GCLOUD_PROJECT || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99c180135f056351 — Environment-variable access.
pkgs/npm/[email protected]/lib/index.js:120 
        const keyFilename = opts.keyFilename || process.env.GCS_KEYFILE || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ea09f9fb8f8ee750 — Environment-variable access.
pkgs/npm/[email protected]/lib/index.spec.js:9 
        process.env.GCS_BUCKET = 'test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7d89d277ef04271d — Environment-variable access.
pkgs/npm/[email protected]/lib/index.spec.js:10 
        process.env.GCLOUD_PROJECT = 'test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c0764ce383995f27 — Environment-variable access.
pkgs/npm/[email protected]/lib/index.spec.js:11 
        process.env.GCS_KEYFILE = './test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #149bcd1d1082c74e — Environment-variable access.
pkgs/npm/[email protected]/lib/index.spec.js:14 
        delete process.env.GCS_BUCKET;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e62d685a6bb77ce1 — Environment-variable access.
pkgs/npm/[email protected]/lib/index.spec.js:15 
        delete process.env.GCLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #490649f6c49aece0 — Environment-variable access.
pkgs/npm/[email protected]/lib/index.spec.js:16 
        delete process.env.GCS_KEYFILE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0af867581bd084bc — Environment-variable access.
pkgs/npm/[email protected]/src/index.spec.ts:12 
    process.env.GCS_BUCKET = 'test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6f4dd6cf5494023e — Environment-variable access.
pkgs/npm/[email protected]/src/index.spec.ts:13 
    process.env.GCLOUD_PROJECT = 'test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e9c6d7342465d204 — Environment-variable access.
pkgs/npm/[email protected]/src/index.spec.ts:14 
    process.env.GCS_KEYFILE = './test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #30ea20f20912fe24 — Environment-variable access.
pkgs/npm/[email protected]/src/index.spec.ts:19 
    delete process.env.GCS_BUCKET;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #50dfce0e850539d3 — Environment-variable access.
pkgs/npm/[email protected]/src/index.spec.ts:20 
    delete process.env.GCLOUD_PROJECT;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #68a9ee5582eb52d6 — Environment-variable access.
pkgs/npm/[email protected]/src/index.spec.ts:21 
    delete process.env.GCS_KEYFILE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7f59268b77b25f9c — Environment-variable access.
pkgs/npm/[email protected]/src/index.ts:111 
		const bucket = opts.bucket || process.env.GCS_BUCKET || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d6df0e45d0ab6e5 — Environment-variable access.
pkgs/npm/[email protected]/src/index.ts:112 
		const projectId = opts.projectId || process.env.GCLOUD_PROJECT || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4c9de4cebadec34e — Environment-variable access.
pkgs/npm/[email protected]/src/index.ts:113 
		const keyFilename = opts.keyFilename || process.env.GCS_KEYFILE || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mysql2

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #0c089e30f842e9ef — Environment-variable access.
pkgs/npm/[email protected]/lib/packets/index.js:60 
  if (process.env.NODE_DEBUG) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

nanoid

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #c3659c4d6965b724 — Filesystem access.
pkgs/npm/[email protected]/bin/nanoid.js:18 
  let json = readFileSync(join(import.meta.dirname, '..', 'package.json'))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

node-cron

npm dependency
expand_more 14 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #c2a10fb5e6f2f138 — Filesystem access.
pkgs/npm/[email protected]__reposrc/rollup.config.js:5 
import { rmSync } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #633feb7706cbfdac — Environment-variable access.
pkgs/npm/[email protected]__reposrc/rollup.config.js:31 
    noEmitOnError: process.env.NODE_ENV !== "development",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #462d28f4ccf9168b — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:5 
    delete process.env.NODE_CRON_RUN;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #acf736a1b38ecce1 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:6 
    delete process.env.CUSTOM_RUN_FLAG;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9ff4160a70cd9b42 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:14 
    process.env.NODE_CRON_RUN = 'yes';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1d0840698bc0c55a — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:19 
    process.env.NODE_CRON_RUN = 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8ba4db79fbf6e392 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:25 
    process.env.NODE_CRON_RUN = 'false';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #05fc39d889f825a2 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:31 
    process.env.CUSTOM_RUN_FLAG = 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #05c0db61c235a039 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:37 
    process.env.NODE_CRON_RUN = 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7753afee021338d5 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.test.ts:39 
    delete process.env.NODE_CRON_RUN;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f00e262c0cf35a90 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/env-var-run-coordinator.ts:25 
    const value = process.env[this.envName];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4d9dbce251c96dfb — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/run-coordinator.test.ts:123 
      delete process.env.NODE_CRON_RUN;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3ea3d448672cdba3 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/coordinator/run-coordinator.test.ts:147 
      process.env.NODE_CRON_RUN = 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #67567c17c87ef179 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/src/time/dst-fuzz.test.ts:9 
const SEED = Number(process.env.FUZZ_SEED) || 0xC0FFEE;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

nodemailer

npm dependency
expand_more 7 low-confidence finding(s)
low env_fs dependency Excluded from app score #8b873599d459d8af — Filesystem access.
pkgs/npm/[email protected]/lib/dkim/index.js:10 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cd83898b3ddff4b1 — Filesystem access.
pkgs/npm/[email protected]/lib/mime-node/index.js:6 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93bc2b264607b114 — Environment-variable access.
pkgs/npm/[email protected]/lib/nodemailer.js:15 
const ETHEREAL_API = (process.env.ETHEREAL_API || 'https://api.nodemailer.com').replace(/\/+$/, '');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48bbd0ef8d5b4e93 — Environment-variable access.
pkgs/npm/[email protected]/lib/nodemailer.js:16 
const ETHEREAL_WEB = (process.env.ETHEREAL_WEB || 'https://ethereal.email').replace(/\/+$/, '');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9cb9f6b39617d79 — Environment-variable access.
pkgs/npm/[email protected]/lib/nodemailer.js:17 
const ETHEREAL_API_KEY = (process.env.ETHEREAL_API_KEY || '').replace(/\s*/g, '') || null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #493eff609c51cbda — Environment-variable access.
pkgs/npm/[email protected]/lib/nodemailer.js:18 
const ETHEREAL_CACHE = ['true', 'yes', 'y', '1'].includes((process.env.ETHEREAL_CACHE || 'yes').toString().trim().toLowerCase());

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5aee564ba8e034a2 — Filesystem access.
pkgs/npm/[email protected]/lib/shared/index.js:7 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

npm dependency
expand_more 186 low-confidence finding(s)
low env_fs dependency Excluded from app score #d4d77a4b000c7622 — Environment-variable access.
pkgs/npm/[email protected]/azure.js:44 
                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a185b7f7e676abd — Environment-variable access.
pkgs/npm/[email protected]/azure.mjs:40 
                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #d5a599d93d1baf85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.js:19 
        return this._client.get((0, path_1.path) `/batches/${batchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56d6706e3bc4ef1f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.js:33 
        return this._client.post((0, path_1.path) `/batches/${batchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #37904bdb196b7a50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.mjs:16 
        return this._client.get(path `/batches/${batchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #33568b416fcf8449 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.mjs:30 
        return this._client.post(path `/batches/${batchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #35345a40fa29863f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.js:28 
        return this._client.get((0, path_1.path) `/assistants/${assistantID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #241f38c6e690616c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.js:39 
        return this._client.post((0, path_1.path) `/assistants/${assistantID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa409d2413861683 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.mjs:25 
        return this._client.get(path `/assistants/${assistantID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a1ef6a03ca520618 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.mjs:36 
        return this._client.post(path `/assistants/${assistantID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9f2c18776517656a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/sessions.js:38 
        return this._client.post((0, path_1.path) `/chatkit/sessions/${sessionID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d31b75478759ed4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/sessions.mjs:35 
        return this._client.post(path `/chatkit/sessions/${sessionID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5d94cf28a4cea423 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/threads.js:20 
        return this._client.get((0, path_1.path) `/chatkit/threads/${threadID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7c25a34ce3aaefc8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/threads.mjs:17 
        return this._client.get(path `/chatkit/threads/${threadID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #575fbe2e26b32c48 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.js:19 
        return this._client.post((0, path_1.path) `/threads/${threadID}/messages`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be011c64e6d5df10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.js:32 
        return this._client.get((0, path_1.path) `/threads/${thread_id}/messages/${messageID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #077a31c39be2c580 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.js:44 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/messages/${messageID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ddeb7b4702a3d1f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:16 
        return this._client.post(path `/threads/${threadID}/messages`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b40942daf6f6517f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:29 
        return this._client.get(path `/threads/${thread_id}/messages/${messageID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b0e0537ee2e33f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:41 
        return this._client.post(path `/threads/${thread_id}/messages/${messageID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a846d422be6475a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:24 
        return this._client.post((0, path_1.path) `/threads/${threadID}/runs`, {
            query: { include },
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c015fa21edea9c1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:39 
        return this._client.get((0, path_1.path) `/threads/${thread_id}/runs/${runID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ea0c80fa523fb81d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:51 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #211f8f77ecd4a8d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:76 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #39e10e9287c7bf15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:155 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #88ab007800c8243d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:20 
        return this._client.post(path `/threads/${threadID}/runs`, {
            query: { include },
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bc042fbabdf3ae4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:35 
        return this._client.get(path `/threads/${thread_id}/runs/${runID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42a67d47922078ca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:47 
        return this._client.post(path `/threads/${thread_id}/runs/${runID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b768552dbf40c454 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:72 
        return this._client.post(path `/threads/${thread_id}/runs/${runID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #49914a8fd4d569a7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:151 
        return this._client.post(path `/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #670793078500378c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/steps.js:20 
        return this._client.get((0, path_1.path) `/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e5781974c688c52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/steps.mjs:17 
        return this._client.get(path `/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
            query,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #46a84a15b2c4766f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.js:41 
        return this._client.get((0, path_1.path) `/threads/${threadID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7ac6be31894db28f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.js:52 
        return this._client.post((0, path_1.path) `/threads/${threadID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d48f787df643234 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:37 
        return this._client.get(path `/threads/${threadID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1ca398c4ac777a88 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:48 
        return this._client.post(path `/threads/${threadID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #679565b593e4feaf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.js:34 
        return this._client.get((0, path_1.path) `/chat/completions/${completionID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e90825341ec436ba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.js:50 
        return this._client.post((0, path_1.path) `/chat/completions/${completionID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e303d9881198384 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:30 
        return this._client.get(path `/chat/completions/${completionID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d4546b2aa4a737cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:46 
        return this._client.post(path `/chat/completions/${completionID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec8d89a95813140e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/containers.js:27 
        return this._client.get((0, path_1.path) `/containers/${containerID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7848b19352ebae60 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/containers.mjs:23 
        return this._client.get(path `/containers/${containerID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02b927fea42a923c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/content.js:14 
        return this._client.get((0, path_1.path) `/containers/${container_id}/files/${fileID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ed9825b6fdec1414 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/content.mjs:11 
        return this._client.get(path `/containers/${container_id}/files/${fileID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1887671f61dfc98a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.js:25 
        return this._client.post((0, path_1.path) `/containers/${containerID}/files`, (0, uploads_1.multipartFormRequestOptions)({ body, ...options }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #611e915e8ee0fe06 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.js:32 
        return this._client.get((0, path_1.path) `/containers/${container_id}/files/${fileID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8bfa770c28538499 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.mjs:21 
        return this._client.post(path `/containers/${containerID}/files`, multipartFormRequestOptions({ body, ...options }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eab90d3c7c12e9ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.mjs:28 
        return this._client.get(path `/containers/${container_id}/files/${fileID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9db50190adbb5403 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.js:25 
        return this._client.get((0, path_1.path) `/conversations/${conversationID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9fa61def867338f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.js:31 
        return this._client.post((0, path_1.path) `/conversations/${conversationID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02ccfa7076dec820 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.mjs:21 
        return this._client.get(path `/conversations/${conversationID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #48b8315ece496eb9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.mjs:27 
        return this._client.post(path `/conversations/${conversationID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ba92c41d756c1469 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.js:14 
        return this._client.post((0, path_1.path) `/conversations/${conversationID}/items`, {
            query: { include },
            body,
            ...options,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7e58e986d76111d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.js:25 
        return this._client.get((0, path_1.path) `/conversations/${conversation_id}/items/${itemID}`, { query, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02fb723b431bcba1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.mjs:11 
        return this._client.post(path `/conversations/${conversationID}/items`, {
            query: { include },
            body,
            ...options,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b3899abcc004433e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.mjs:22 
        return this._client.get(path `/conversations/${conversation_id}/items/${itemID}`, { query, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #503a8ab6d6c89e88 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.js:31 
        return this._client.get((0, path_1.path) `/evals/${evalID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #6bc385beab3a8ec4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.js:37 
        return this._client.post((0, path_1.path) `/evals/${evalID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #616815cdf2f17b9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.mjs:27 
        return this._client.get(path `/evals/${evalID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #0f0402da4390aabd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.mjs:33 
        return this._client.post(path `/evals/${evalID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #5091136e91aa83ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/output-items.js:14 
        return this._client.get((0, path_1.path) `/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #e79e0599d9550b32 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/output-items.mjs:11 
        return this._client.get(path `/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #4172f74a7831f654 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.js:22 
        return this._client.post((0, path_1.path) `/evals/${evalID}/runs`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #83ccbb8cdad76396 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.js:29 
        return this._client.get((0, path_1.path) `/evals/${eval_id}/runs/${runID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #d04580a73eb77a44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.js:52 
        return this._client.post((0, path_1.path) `/evals/${eval_id}/runs/${runID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #60f05f6a97be6d94 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:18 
        return this._client.post(path `/evals/${evalID}/runs`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #70b56eceef660d6b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:25 
        return this._client.get(path `/evals/${eval_id}/runs/${runID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #06d02a15d08fafa3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:48 
        return this._client.post(path `/evals/${eval_id}/runs/${runID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d9c8e31689a6ce0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.js:42 
        return this._client.get((0, path_1.path) `/files/${fileID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f2603aa7646f1291 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.js:60 
        return this._client.get((0, path_1.path) `/files/${fileID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa3d0b6abb257d41 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.mjs:39 
        return this._client.get(path `/files/${fileID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3bebb87fb4c76f2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.mjs:57 
        return this._client.get(path `/files/${fileID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f64b05953cd26685 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.js:44 
        return this._client.get((0, path_1.path) `/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
            query,
            ...options,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f5744c0fcbe1476 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.mjs:41 
        return this._client.get(path `/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
            query,
            ...options,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a260f8e20ef3692d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:49 
        return this._client.get((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7de25b2db6bca80e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:76 
        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ccd08f1524918ae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:105 
        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/pause`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #77c33cac79862677 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:118 
        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/resume`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b62e40e236eca8c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:45 
        return this._client.get(path `/fine_tuning/jobs/${fineTuningJobID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #871d587785d9aa89 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:72 
        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d7889c5a20e03a71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:101 
        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/pause`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ce0384fc9100fa95 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:114 
        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/resume`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ea4bba9f182bb986 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/models.js:14 
        return this._client.get((0, path_1.path) `/models/${model}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2541a0cfa4a8ade2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/models.mjs:11 
        return this._client.get(path `/models/${model}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6dc950b54ea7164c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:21 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/accept`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #68144874b78d1455 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:36 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/hangup`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7cb976647a7cb983 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:52 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/refer`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79c5bd59abf7eba0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:67 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/reject`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #49117381159bd26f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:18 
        return this._client.post(path `/realtime/calls/${callID}/accept`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e769d40bd3ed15af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:33 
        return this._client.post(path `/realtime/calls/${callID}/hangup`, {
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c009e74a94074b5b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:49 
        return this._client.post(path `/realtime/calls/${callID}/refer`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #84723b3759e78aaf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:64 
        return this._client.post(path `/realtime/calls/${callID}/reject`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ed3d71cf34271632 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.js:30 
        return this._client.get((0, path_1.path) `/responses/${responseID}`, {
            query,
            ...options,
            stream: query?.stream ?? false,
        })._thenUnwrap((rsp) => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e4a16e6d15c6d401 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.js:81 
        return this._client.post((0, path_1.path) `/responses/${responseID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2bc17aa503de63d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.mjs:26 
        return this._client.get(path `/responses/${responseID}`, {
            query,
            ...options,
            stream: query?.stream ?? false,
        })._thenUnwrap((rsp) => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c91de42c210827d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.mjs:77 
        return this._client.post(path `/responses/${responseID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc07fbaf498d54f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/parts.js:23 
        return this._client.post((0, path_1.path) `/uploads/${uploadID}/parts`, (0, uploads_1.multipartFormRequestOptions)({ body, ...options }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #43500756752d6e8a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/parts.mjs:20 
        return this._client.post(path `/uploads/${uploadID}/parts`, multipartFormRequestOptions({ body, ...options }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c84a08c75d5e32e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.js:43 
        return this._client.post((0, path_1.path) `/uploads/${uploadID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be2d10cc57cf98c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.js:61 
        return this._client.post((0, path_1.path) `/uploads/${uploadID}/complete`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0daabf95d73545ac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.mjs:39 
        return this._client.post(path `/uploads/${uploadID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5476303beb7866e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.mjs:57 
        return this._client.post(path `/uploads/${uploadID}/complete`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ccf7cebbe17a812c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:16 
        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}/file_batches`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dfb682f3a09232c9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:27 
        return this._client.get((0, path_1.path) `/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2c02488ccb188111 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:38 
        return this._client.post((0, path_1.path) `/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c61e124321416b0a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:13 
        return this._client.post(path `/vector_stores/${vectorStoreID}/file_batches`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c244813ae25ef75d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:24 
        return this._client.get(path `/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #70e703b726cb801c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:35 
        return this._client.post(path `/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #51f43ed6fc061b9b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.js:17 
        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}/files`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d1e93f72163fa361 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.js:28 
        return this._client.get((0, path_1.path) `/vector_stores/${vector_store_id}/files/${fileID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b98ce3047f917f5d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.js:38 
        return this._client.post((0, path_1.path) `/vector_stores/${vector_store_id}/files/${fileID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0205a57d2e1937f8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:14 
        return this._client.post(path `/vector_stores/${vectorStoreID}/files`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #143a11d52c75cc9c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:25 
        return this._client.get(path `/vector_stores/${vector_store_id}/files/${fileID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #66453aad501224bc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:35 
        return this._client.post(path `/vector_stores/${vector_store_id}/files/${fileID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d58a860578c97f83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:34 
        return this._client.get((0, path_1.path) `/vector_stores/${vectorStoreID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bf58f3ce6c4debd7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:43 
        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #35e3d085e1e0b740 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:30 
        return this._client.get(path `/vector_stores/${vectorStoreID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1fa6994d7158155 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:39 
        return this._client.post(path `/vector_stores/${vectorStoreID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f180fa1b2709dcf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.js:21 
        return this._client.get((0, path_1.path) `/videos/${videoID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eb93b3ba38134c31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.js:39 
        return this._client.get((0, path_1.path) `/videos/${videoID}/content`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d93322add8f72d01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.js:50 
        return this._client.post((0, path_1.path) `/videos/${videoID}/remix`, (0, uploads_1.maybeMultipartFormRequestOptions)({ body, ...options }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dcb3d31ccf8025cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.mjs:18 
        return this._client.get(path `/videos/${videoID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #910904236ceed457 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.mjs:36 
        return this._client.get(path `/videos/${videoID}/content`, {
            query,
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c90edddf87d27f40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.mjs:47 
        return this._client.post(path `/videos/${videoID}/remix`, maybeMultipartFormRequestOptions({ body, ...options }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #b23fa5ae73d2998a — Environment-variable access.
pkgs/npm/[email protected]/src/azure.ts:97 
        endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #332ac4950df886da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/batches.ts:23 
    return this._client.get(path`/batches/${batchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8ce728a1a6f1b8e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/batches.ts:42 
    return this._client.post(path`/batches/${batchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c3a562339400e410 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/assistants.ts:36 
    return this._client.get(path`/assistants/${assistantID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a4973f8e501350b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/assistants.ts:48 
    return this._client.post(path`/assistants/${assistantID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e876ec8508f7cf91 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/chatkit/sessions.ts:41 
    return this._client.post(path`/chatkit/sessions/${sessionID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #92cbbee03ce58c82 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/chatkit/threads.ts:26 
    return this._client.get(path`/chatkit/threads/${threadID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a7e7085aef364422 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:22 
    return this._client.post(path`/threads/${threadID}/messages`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #711a7c3197da26af — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:36 
    return this._client.get(path`/threads/${thread_id}/messages/${messageID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cd422f191f305459 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:49 
    return this._client.post(path`/threads/${thread_id}/messages/${messageID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b8e89aae76b3ccdd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:72 
    return this._client.post(path`/threads/${threadID}/runs`, {
      query: { include },
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      stream: params.stream ?? false,
    }) as APIPromise<Run> | APIPromise<Stream<AssistantsAPI.AssistantStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #34ff7704e935ff43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:88 
    return this._client.get(path`/threads/${thread_id}/runs/${runID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #824aa62d923737ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:101 
    return this._client.post(path`/threads/${thread_id}/runs/${runID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac716a24e0c2bafd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:132 
    return this._client.post(path`/threads/${thread_id}/runs/${runID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bfea149f8679d166 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:257 
    return this._client.post(path`/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      stream: params.stream ?? false,
    }) as APIPromise<Run> | APIPromise<Stream<AssistantsAPI.AssistantStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #96d92f8a10c14511 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/steps.ts:23 
    return this._client.get(path`/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
      query,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #be0e89c18fba1e64 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:101 
    return this._client.get(path`/threads/${threadID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #17dccd3f8d2b0d91 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:113 
    return this._client.post(path`/threads/${threadID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #424ff2a57350bdb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:84 
    return this._client.get(path`/chat/completions/${completionID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2be1e9f2a4b8b1db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:105 
    return this._client.post(path`/chat/completions/${completionID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a40fb23cc4f903d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/containers.ts:36 
    return this._client.get(path`/containers/${containerID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f2a3d70fb7d1380d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/files/content.ts:15 
    return this._client.get(path`/containers/${container_id}/files/${fileID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5453e9aa5091dafe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/files/files.ts:28 
    return this._client.post(
      path`/containers/${containerID}/files`,
      multipartFormRequestOptions({ body, ...options }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0cf1738ef5e438e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/files/files.ts:43 
    return this._client.get(path`/containers/${container_id}/files/${fileID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #74fa30d0543e076d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:38 
    return this._client.get(path`/conversations/${conversationID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9393195551de0470 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:49 
    return this._client.post(path`/conversations/${conversationID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f7c4e608b336652f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/items.ts:25 
    return this._client.post(path`/conversations/${conversationID}/items`, {
      query: { include },
      body,
      ...options,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c2976a78b90d74d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/items.ts:41 
    return this._client.get(path`/conversations/${conversation_id}/items/${itemID}`, { query, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #0383223cdc6453b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/evals.ts:49 
    return this._client.get(path`/evals/${evalID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #e2d5de993d0558c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/evals.ts:56 
    return this._client.post(path`/evals/${evalID}`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #c87285a54078aca8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/output-items.ts:20 
    return this._client.get(path`/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #6559111c642b4ec6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:31 
    return this._client.post(path`/evals/${evalID}/runs`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #fe4e76e44ba2b12d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:43 
    return this._client.get(path`/evals/${eval_id}/runs/${runID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #9f6e65d83ab7ba41 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:73 
    return this._client.post(path`/evals/${eval_id}/runs/${runID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #912a42a61535e3f3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/files.ts:45 
    return this._client.get(path`/files/${fileID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #93b30e70c3a75605 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/files.ts:69 
    return this._client.get(path`/files/${fileID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #08708f383d9c4576 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/checkpoints/permissions.ts:58 
    return this._client.get(path`/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
      query,
      ...options,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #152acd0c4c6491db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:55 
    return this._client.get(path`/fine_tuning/jobs/${fineTuningJobID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #92587f48b62ae0b6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:87 
    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #858687d2412b9e97 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:126 
    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/pause`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aba4c7ee1814625e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:140 
    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/resume`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b313f26dd81eaa3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/models.ts:15 
    return this._client.get(path`/models/${model}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c2b6010a3b2f375a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:24 
    return this._client.post(path`/realtime/calls/${callID}/accept`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c92a4beacb0360e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:40 
    return this._client.post(path`/realtime/calls/${callID}/hangup`, {
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #190e0f8315327b0c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:57 
    return this._client.post(path`/realtime/calls/${callID}/refer`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dcd76946fe56a22a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:77 
    return this._client.post(path`/realtime/calls/${callID}/reject`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #106406ff1c9b58ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/responses/responses.ts:145 
      this._client.get(path`/responses/${responseID}`, {
        query,
        ...options,
        stream: query?.stream ?? false,
      }) as APIPromise<Response> | APIPromise<Stream<ResponseStreamEvent>>

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b7e19f716e5104a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/responses/responses.ts:208 
    return this._client.post(path`/responses/${responseID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4d54d114938444e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/uploads/parts.ts:25 
    return this._client.post(
      path`/uploads/${uploadID}/parts`,
      multipartFormRequestOptions({ body, ...options }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #da0b7f864085666e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:43 
    return this._client.post(path`/uploads/${uploadID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e6bf614b097aa4b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:62 
    return this._client.post(path`/uploads/${uploadID}/complete`, { body, ...options });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1414838ac2783df8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:25 
    return this._client.post(path`/vector_stores/${vectorStoreID}/file_batches`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c8afa81add32b399 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:41 
    return this._client.get(path`/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb60027b3f02a1bc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:57 
    return this._client.post(path`/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c5dd8e7b877d587f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:24 
    return this._client.post(path`/vector_stores/${vectorStoreID}/files`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #807868de9d99674c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:40 
    return this._client.get(path`/vector_stores/${vector_store_id}/files/${fileID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2bc2e4e9bc7ea995 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:51 
    return this._client.post(path`/vector_stores/${vector_store_id}/files/${fileID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b30bcdbb9923198e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:54 
    return this._client.get(path`/vector_stores/${vectorStoreID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #90fc47fb3aa0e507 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:68 
    return this._client.post(path`/vector_stores/${vectorStoreID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6dce54f50aae9da9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/videos.ts:24 
    return this._client.get(path`/videos/${videoID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec0e2c062506837e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/videos.ts:52 
    return this._client.get(path`/videos/${videoID}/content`, {
      query,
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb76fd49aab35d50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/videos.ts:64 
    return this._client.post(
      path`/videos/${videoID}/remix`,
      maybeMultipartFormRequestOptions({ body, ...options }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

pg

npm dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #c74c1d7f4ca12e5a — Environment-variable access.
pkgs/npm/[email protected]/lib/connection-parameters.js:15 
    envVar = process.env['PG' + key.toUpperCase()]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0cc7395d6c271b09 — Environment-variable access.
pkgs/npm/[email protected]/lib/connection-parameters.js:19 
    envVar = process.env[envVar]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94b2dadf5b81d2a2 — Environment-variable access.
pkgs/npm/[email protected]/lib/connection-parameters.js:26 
  switch (process.env.PGSSLMODE) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f46ea1a472dc149 — Environment-variable access.
pkgs/npm/[email protected]/lib/connection-parameters.js:127 
      this.connect_timeout = process.env.PGCONNECT_TIMEOUT || 0

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #012a29cc39c79dde — Environment-variable access.
pkgs/npm/[email protected]/lib/defaults.js:5 
  user = process.platform === 'win32' ? process.env.USERNAME : process.env.USER

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #523c504b62bbbe8d — Environment-variable access.
pkgs/npm/[email protected]/lib/index.js:41 
  forceNative = !!process.env.NODE_PG_FORCE_NATIVE

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

prom-client

npm dependency
expand_more 6 low-confidence finding(s)
low env_fs dependency Excluded from app score #4089d27ce70697ad — Filesystem access.
pkgs/npm/[email protected]/lib/metrics/osMemoryHeapLinux.js:4 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86d8f85b4e3b856c — Filesystem access.
pkgs/npm/[email protected]/lib/metrics/osMemoryHeapLinux.js:53 
				const stat = fs.readFileSync('/proc/self/status', 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e523adea62205e52 — Filesystem access.
pkgs/npm/[email protected]/lib/metrics/processMaxFileDescriptors.js:4 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #eaee081ce1b7e10e — Filesystem access.
pkgs/npm/[email protected]/lib/metrics/processMaxFileDescriptors.js:14 
			const limits = fs.readFileSync('/proc/self/limits', 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c2fd31daca7e7f26 — Filesystem access.
pkgs/npm/[email protected]/lib/metrics/processOpenFileDescriptors.js:4 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #10fa5b61b1f6b636 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/lib/pushgateway.js:74 
		const req = httpModule.request(options, resp => {
			let body = '';
			resp.setEncoding('utf8');
			resp.on('data', chunk => {
				body += chunk;
			});
			resp.on('end', () => {
				if (resp.statusCode >= 400) {
					reject(
						new Error(`push failed with status ${resp.statusCode}, ${body}`),
					);
				} else {
					resolve({ resp, body });
				}
			});
		});

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

s3-streamlogger

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #99bb463abc7110a2 — Environment-variable access.
pkgs/npm/[email protected]/index.js:18 
    if(!(options.bucket || process.env.BUCKET_NAME))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a583c2f7d1ce388 — Environment-variable access.
pkgs/npm/[email protected]/index.js:21 
    this.bucket                 = options.bucket || process.env.BUCKET_NAME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sqlite3

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #113dc2b6615a0660 — Filesystem access.
pkgs/npm/[email protected]/deps/extract.js:2 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

stripe

npm dependency
expand_more 12 low-confidence finding(s)
low egress dependency Excluded from app score #07582d1bc4eb2720 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/cjs/net/NodeHttpClient.js:37 
            const req = (isInsecureConnection ? http : https).request({
                host: host,
                port: port,
                path,
                method,
                agent,
                headers,
                ciphers: 'DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2:!MD5',
            });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #d9935bd2c4417116 — Filesystem access.
pkgs/npm/[email protected]/cjs/platform/NodePlatformFunctions.js:5 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf9fac8267342330 — Filesystem access.
pkgs/npm/[email protected]/cjs/platform/NodePlatformFunctions.js:65 
            const content = fs.readFileSync(filePath, 'utf8').trim();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0b3790dbfbb91b9f — Filesystem access.
pkgs/npm/[email protected]/cjs/platform/NodePlatformFunctions.js:78 
            fs.writeFileSync(filePath, newId, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e497dc608f800d11 — Environment-variable access.
pkgs/npm/[email protected]/cjs/platform/NodePlatformFunctions.js:89 
            const appData = process.env.APPDATA;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #11bec520ed63259d — Environment-variable access.
pkgs/npm/[email protected]/cjs/platform/NodePlatformFunctions.js:94 
        const xdg = process.env.XDG_CONFIG_HOME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #13897286ab8a40c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/esm/net/NodeHttpClient.js:34 
            const req = (isInsecureConnection ? http : https).request({
                host: host,
                port: port,
                path,
                method,
                agent,
                headers,
                ciphers: 'DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2:!MD5',
            });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #15999b717b5dad43 — Filesystem access.
pkgs/npm/[email protected]/esm/platform/NodePlatformFunctions.js:2 
import * as fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b2712ff039517970 — Filesystem access.
pkgs/npm/[email protected]/esm/platform/NodePlatformFunctions.js:62 
            const content = fs.readFileSync(filePath, 'utf8').trim();

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df05033f1318a905 — Filesystem access.
pkgs/npm/[email protected]/esm/platform/NodePlatformFunctions.js:75 
            fs.writeFileSync(filePath, newId, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #39fea6fb17bcbe47 — Environment-variable access.
pkgs/npm/[email protected]/esm/platform/NodePlatformFunctions.js:86 
            const appData = process.env.APPDATA;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c215b4b9407eed9 — Environment-variable access.
pkgs/npm/[email protected]/esm/platform/NodePlatformFunctions.js:91 
        const xdg = process.env.XDG_CONFIG_HOME;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

typeorm

npm dependency
expand_more 30 low-confidence finding(s)
low egress dependency Excluded from app score #d44371dc476c8127 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/browser/cache/RedisQueryResultCache.js:94 
        const result = await this.client.get(key);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #27d5ba2aa2679a26 — Environment-variable access.
pkgs/npm/[email protected]/browser/cli-ts-node-esm.js:5 
if ((process.env["NODE_OPTIONS"] ?? "").includes("--loader ts-node"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f998ba6d57d0fa0 — Environment-variable access.
pkgs/npm/[email protected]/browser/cli-ts-node-esm.js:13 
                process.env["NODE_OPTIONS"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9aebf769bdd38243 — Environment-variable access.
pkgs/npm/[email protected]/browser/driver/oracle/OracleDriver.js:221 
            process.env.ORA_SDTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad039da27f079632 — Environment-variable access.
pkgs/npm/[email protected]/browser/driver/postgres/PostgresDriver.js:273 
            process.env.PGTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87524225ac1e35bb — Filesystem access.
pkgs/npm/[email protected]/browser/driver/sqljs/SqljsDriver.js:66 
                    const database = PlatformTools_1.PlatformTools.readFileSync(fileNameOrLocalStorageOrData);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6a1cd043e3855698 — Filesystem access.
pkgs/npm/[email protected]/browser/driver/sqljs/SqljsDriver.js:135 
                await PlatformTools_1.PlatformTools.writeFile(path, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8bb0d87ead9169ba — Filesystem access.
pkgs/npm/[email protected]/browser/platform/PlatformTools.d.ts:3 
export { ReadStream } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d2ac05db9db70f9 — Filesystem access.
pkgs/npm/[email protected]/browser/platform/PlatformTools.js:8 
const fs_1 = tslib_1.__importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #49a4df966715de0a — Filesystem access.
pkgs/npm/[email protected]/browser/platform/PlatformTools.js:13 
var fs_2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #961e1bfbbfe89b2e — Filesystem access.
pkgs/npm/[email protected]/browser/platform/PlatformTools.js:137 
        return fs_1.default.readFileSync(filename);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25779ad1d25ebff7 — Filesystem access.
pkgs/npm/[email protected]/browser/platform/PlatformTools.js:143 
        return fs_1.default.promises.writeFile(path, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47972b8c0caa9ca4 — Filesystem access.
pkgs/npm/[email protected]/browser/util/ImportUtils.js:88 
                const parsedPackage = JSON.parse(await promises_1.default.readFile(potentialPackageJson, "utf8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #fb99ec6193bf2406 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/cache/RedisQueryResultCache.js:94 
        const result = await this.client.get(key);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #d5ece752ef224305 — Environment-variable access.
pkgs/npm/[email protected]/cli-ts-node-esm.js:5 
if ((process.env["NODE_OPTIONS"] ?? "").includes("--loader ts-node"))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3c61a46ecc404ab0 — Environment-variable access.
pkgs/npm/[email protected]/cli-ts-node-esm.js:13 
                process.env["NODE_OPTIONS"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9c37285f7c5e8a86 — Filesystem access.
pkgs/npm/[email protected]/commands/CommandUtils.js:71 
        await promises_1.default.writeFile(filePath, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a1769860ccf66b8f — Filesystem access.
pkgs/npm/[email protected]/commands/CommandUtils.js:79 
        const file = await promises_1.default.readFile(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f742c52df2fb20e — Filesystem access.
pkgs/npm/[email protected]/commands/InitCommand.js:79 
            const packageJsonContents = await CommandUtils_1.CommandUtils.readFile(basePath + "/package.json");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2f4f590ef401c40f — Filesystem access.
pkgs/npm/[email protected]/commands/InitCommand.js:597 
        const ourPackageJson = JSON.parse(await CommandUtils_1.CommandUtils.readFile(node_path_1.default.resolve(__dirname, "..", "package.json")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18acf1326c96694e — Environment-variable access.
pkgs/npm/[email protected]/driver/oracle/OracleDriver.js:221 
            process.env.ORA_SDTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c9213cb3aecd251b — Environment-variable access.
pkgs/npm/[email protected]/driver/postgres/PostgresDriver.js:273 
            process.env.PGTZ = "UTC";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd6541239734eae3 — Filesystem access.
pkgs/npm/[email protected]/driver/sqljs/SqljsDriver.js:66 
                    const database = PlatformTools_1.PlatformTools.readFileSync(fileNameOrLocalStorageOrData);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #47ece01a6769f453 — Filesystem access.
pkgs/npm/[email protected]/driver/sqljs/SqljsDriver.js:135 
                await PlatformTools_1.PlatformTools.writeFile(path, content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa83466999b2f3a5 — Filesystem access.
pkgs/npm/[email protected]/platform/PlatformTools.d.ts:3 
export { ReadStream } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f09f2572abf217c6 — Filesystem access.
pkgs/npm/[email protected]/platform/PlatformTools.js:8 
const fs_1 = tslib_1.__importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0229328c2361453d — Filesystem access.
pkgs/npm/[email protected]/platform/PlatformTools.js:13 
var fs_2 = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2df3765d717fb23 — Filesystem access.
pkgs/npm/[email protected]/platform/PlatformTools.js:137 
        return fs_1.default.readFileSync(filename);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #90c099e845aaa962 — Filesystem access.
pkgs/npm/[email protected]/platform/PlatformTools.js:143 
        return fs_1.default.promises.writeFile(path, data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e444181ee0d77cae — Filesystem access.
pkgs/npm/[email protected]/util/ImportUtils.js:88 
                const parsedPackage = JSON.parse(await promises_1.default.readFile(potentialPackageJson, "utf8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

winston-daily-rotate-file

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #08da4fe8d7d4597b — Filesystem access.
pkgs/npm/[email protected]/daily-rotate-file.js:1 
const fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @keyv/redis prod — dist-only: no readable source
  • @types/bcryptjs prod — no javascript source
  • cache-manager prod — dist-only: no readable source
  • geoip-lite prod — tarball exceeds byte cap
  • @getzep/zep-cloud prod — scan budget exceeded
  • @getzep/zep-js prod — scan budget exceeded
  • @gomomento/sdk prod — scan budget exceeded
  • @gomomento/sdk-core prod — scan budget exceeded
  • @google-ai/generativelanguage prod — scan budget exceeded
  • @google-cloud/storage prod — scan budget exceeded
  • @google/generative-ai prod — scan budget exceeded
  • @grpc/grpc-js prod — scan budget exceeded
  • @huggingface/inference prod — scan budget exceeded
  • @ibm-cloud/watsonx-ai prod — scan budget exceeded
  • @langchain/anthropic prod — scan budget exceeded
  • @langchain/aws prod — scan budget exceeded
  • @langchain/baidu-qianfan prod — scan budget exceeded
  • @langchain/classic prod — scan budget exceeded
  • @langchain/cloudflare prod — scan budget exceeded
  • @langchain/cohere prod — scan budget exceeded
  • @langchain/community prod — scan budget exceeded
  • @langchain/core prod — scan budget exceeded
  • @langchain/deepseek prod — scan budget exceeded
  • @langchain/exa prod — scan budget exceeded
  • @langchain/google-genai prod — scan budget exceeded
  • @langchain/google-vertexai prod — scan budget exceeded
  • @langchain/groq prod — scan budget exceeded
  • @langchain/langgraph prod — scan budget exceeded
  • @langchain/mistralai prod — scan budget exceeded
  • @langchain/mongodb prod — scan budget exceeded
  • @langchain/ollama prod — scan budget exceeded
  • @langchain/openai prod — scan budget exceeded
  • @langchain/pinecone prod — scan budget exceeded
  • @langchain/qdrant prod — scan budget exceeded
  • @langchain/redis prod — scan budget exceeded
  • @langchain/tavily prod — scan budget exceeded
  • @langchain/textsplitters prod — scan budget exceeded
  • @langchain/weaviate prod — scan budget exceeded
  • @langchain/xai prod — scan budget exceeded
  • @mem0/community prod — scan budget exceeded
  • @mendable/firecrawl-js prod — scan budget exceeded
  • @mistralai/mistralai prod — scan budget exceeded
  • @modelcontextprotocol/server-postgres prod — scan budget exceeded
  • @modelcontextprotocol/server-sequential-thinking prod — scan budget exceeded
  • @modelcontextprotocol/server-slack prod — scan budget exceeded
  • @notionhq/client prod — scan budget exceeded
  • @opensearch-project/opensearch prod — scan budget exceeded
  • @pinecone-database/pinecone prod — scan budget exceeded
  • @qdrant/js-client-rest prod — scan budget exceeded
  • @stripe/agent-toolkit prod — scan budget exceeded
  • @supabase/supabase-js prod — scan budget exceeded
  • @types/js-yaml prod — scan budget exceeded
  • @types/jsdom prod — scan budget exceeded
  • @upstash/redis prod — scan budget exceeded
  • @upstash/vector prod — scan budget exceeded
  • @zilliz/milvus2-sdk-node prod — scan budget exceeded
  • apify-client prod — scan budget exceeded
  • assemblyai prod — scan budget exceeded
  • cheerio prod — scan budget exceeded
  • chromadb prod — scan budget exceeded
  • cohere-ai prod — scan budget exceeded
  • composio-core prod — scan budget exceeded
  • couchbase prod — scan budget exceeded
  • css-what prod — scan budget exceeded
  • d3-dsv prod — scan budget exceeded
  • epub2 prod — scan budget exceeded
  • exa-js prod — scan budget exceeded
  • faiss-node prod — scan budget exceeded
  • fast-json-patch prod — scan budget exceeded
  • form-data prod — scan budget exceeded
  • google-auth-library prod — scan budget exceeded
  • graphql prod — scan budget exceeded
  • groq-sdk prod — scan budget exceeded
  • html-to-text prod — scan budget exceeded
  • ioredis prod — scan budget exceeded
  • ipaddr.js prod — scan budget exceeded
  • jsdom prod — scan budget exceeded
  • json5 prod — scan budget exceeded
  • jsonpointer prod — scan budget exceeded
  • jsonrepair prod — scan budget exceeded
  • langchain prod — scan budget exceeded
  • langfuse prod — scan budget exceeded
  • langfuse-langchain prod — scan budget exceeded
  • langsmith prod — scan budget exceeded
  • langwatch prod — scan budget exceeded
  • linkifyjs prod — scan budget exceeded
  • llamaindex prod — scan budget exceeded
  • lunary prod — scan budget exceeded
  • mammoth prod — scan budget exceeded
  • meilisearch prod — scan budget exceeded
  • mongodb prod — scan budget exceeded
  • neo4j-driver prod — scan budget exceeded
  • node-fetch prod — scan budget exceeded
  • node-html-markdown prod — scan budget exceeded
  • notion-to-md prod — scan budget exceeded