Close Open Privacy Scan
App Privacy Score
82
/100
Low privacy risk
Low risk · 2076 finding(s)
Based on: 1 first-party package(s) · 27/35 deps analyzed
Dependency score: 67 (Medium risk)
bar_chart Score Breakdown
egress
−15
env_fs
−3
list Scan Summary
0 high
1 medium
2075 low
First-party packages:
1
Dependency packages:
23
Ecosystem:
python
swap_horiz Application data flows
No application data flows were found. See dependency data flows below.
hub Dependency data flows (1)
medium
transformers
dependency
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
- 1source
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 - 2sink
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
</> First-Party Code
first-party (python)
python first-partyexpand_more 394 low-confidence finding(s)
low env_fs — Filesystem access. 127 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 246 locations
low env_fs — Environment-variable access. 21 locations
</> Dependencies
transformers
python dependency
medium
pii_flow
dependency
Excluded from app score
#1f22e170f3498d1a
—
PII-bearing data is written to a log/print sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
· flow /tmp/closeopen-0l8qh44d/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2512 → /tmp/closeopen-0l8qh44d/pkgs/python/[email protected]/src/transformers/integrations/integration_utils.py:2514
logger.debug(f"[Kubeflow] Token file not found: {token_path}")PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 399 low-confidence finding(s)
low env_fs — Filesystem access. 249 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 13 locations
low env_fs — Environment-variable access. 136 locations
low
egress
dependency
Excluded from app score
#ca12f792556b0b37
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/src/transformers/utils/attention_visualizer.py:183
img = Image.open(io.BytesIO(httpx.get(img, follow_redirects=True).content))Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
PyOpenGL
python dependencyexpand_more 66 low-confidence finding(s)
low env_fs — Filesystem access. 49 locations
low env_fs — Environment-variable access. 14 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 2 locations
low
egress
dependency
Excluded from app score
#fa2d4e3e5a226d66
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/src/get_gles_extensions.py:33
response = requests.get( url )Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
SQLAlchemy
python dependencyexpand_more 29 low-confidence finding(s)
low
egress
dependency
Excluded from app score
#f2a3adc965cf19bd
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/lib/sqlalchemy/pool/impl.py:145
self._pool.put(record, False)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs — Filesystem access. 19 locations
low env_fs — Environment-variable access. 9 locations
aiohttp
python dependencyexpand_more 30 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
low env_fs — Environment-variable access. 9 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 6 locations
alembic
python dependencyexpand_more 30 low-confidence finding(s)
low env_fs — Filesystem access. 14 locations
low env_fs — Environment-variable access. 16 locations
av
python dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Environment-variable access. 5 locations
low
egress
dependency
Excluded from app score
#e485ab71200a872b
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/av/datasets.py:76
response = urlopen(url)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
blake3
python dependencyexpand_more 2 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#409fdd1ae0c007a2
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/c_impl/setup.py:69
return os.environ.get("FORCE_INTRINSICS") == "1"Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low
env_fs
dependency
Excluded from app score
#00c92cdf45349e19
capability detected · no path traced
—
Filesystem access.
pkgs/python/[email protected]/c_impl/setup.py:259
long_description=open("README.md").read(),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
comfyui-frontend-package
python dependencyexpand_more 1 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#119cc54f63b9e082
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/setup.py:6
version=os.getenv("COMFYUI_FRONTEND_VERSION") or "0.1.0",Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
filelock
python dependencyexpand_more 6 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
low env_fs — Environment-variable access. 4 locations
kornia
python dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 2 locations
low env_fs — Filesystem access. 5 locations
low
egress
dependency
Excluded from app score
#e86bc2ac1f542dd8
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/kornia/onnx/utils.py:142
response = requests.get(url, timeout=10) # type:ignoreData is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
numpy
python dependencyexpand_more 982 low-confidence finding(s)
low env_fs — Filesystem access. 618 locations
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:106
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:155
pkgs/python/[email protected]/vendored-meson/meson/mesonbuild/interpreterbase/interpreterbase.py:676
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/105 generatorcustom/catter.py:8
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/129 build by default/mygen.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:2
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/228 custom_target source/x.py:4
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage1.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:5
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/262 generator chain/stage2.py:6
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen1.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/71 ctarget dependency/gen2.py:9
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:10
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:43
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:50
pkgs/python/[email protected]/vendored-meson/meson/test cases/common/95 manygen/subdir/manygen.py:57
low env_fs — Environment-variable access. 356 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low egress — Hardcoded external endpoint. Review what data is sent to this destination. 3 locations
psutil
python dependencyexpand_more 28 low-confidence finding(s)
low env_fs — Filesystem access. 19 locations
low env_fs — Environment-variable access. 7 locations
low
egress
tooling
Excluded from app score
unreachable
#114639615eb859a9
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/find_broken_links.py:194
res = requests.get(url, timeout=REQUEST_TIMEOUT)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low
egress
tooling
Excluded from app score
unreachable
#6ef44de98f39f132
capability detected · no path traced
—
Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/python/[email protected]/scripts/internal/install_pip.py:34
req = urlopen(URL, **kwargs)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
pydantic
python dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 5 locations
pydantic-settings
python dependencyexpand_more 3 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#4b811bb1ee138943
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/pydantic_settings/sources/providers/env.py:75
return parse_env_vars(os.environ, self.case_sensitive, self.env_ignore_empty, self.env_parse_none_str)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Filesystem access. 2 locations
pyyaml
python dependencyexpand_more 3 low-confidence finding(s)
low env_fs — Environment-variable access. 3 locations
requests
python dependencyexpand_more 8 low-confidence finding(s)
low env_fs — Environment-variable access. 8 locations
safetensors
python dependencyexpand_more 9 low-confidence finding(s)
low env_fs — Filesystem access. 9 locations
sentencepiece
python dependencyexpand_more 10 low-confidence finding(s)
low env_fs — Filesystem access. 9 locations
low
env_fs
dependency
Excluded from app score
#1f2bc41aa38d888b
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/setup.py:276
if os.getenv('PYTHON_ARCH', '') == 'ARM64':Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
simpleeval
python dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
tokenizers
python dependencyexpand_more 12 low-confidence finding(s)
low
env_fs
dependency
Excluded from app score
#4dc09c2c06a2f3d8
capability detected · no path traced
—
Environment-variable access.
pkgs/python/[email protected]/bindings/python/benches/test_tiktoken.py:29
os.environ["RAYON_NUM_THREADS"] = str(num_threads)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs — Filesystem access. 10 locations
low
egress
tooling
Excluded from app score
unreachable
#4970b3f736d18137
capability detected · no path traced
—
Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/python/[email protected]/bindings/python/scripts/sentencepiece_extractor.py:121
response = get(args.model, allow_redirects=True)Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
torchsde
python dependencyexpand_more 2 low-confidence finding(s)
low env_fs — Filesystem access. 2 locations
tqdm
python dependencyexpand_more 20 low-confidence finding(s)
low env_fs — Filesystem access. 10 locations
low egress — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination. 5 locations
low env_fs — Environment-variable access. 5 locations
yarl
python dependencyexpand_more 12 low-confidence finding(s)
low env_fs — Environment-variable access. 10 locations
low env_fs — Filesystem access. 2 locations
Skipped dependencies
Production
- torch prod — no sdist (wheels only)
- torchvision prod — no sdist (wheels only)
- torchaudio prod — no sdist (wheels only)
- Pillow prod — sdist exceeds byte cap
- scipy prod — sdist exceeds byte cap
- comfy-kitchen prod — no sdist (wheels only)
- comfy-aimdo prod — no sdist (wheels only)
- comfy-angle prod — no sdist (wheels only)