Close Open Privacy Scan

link https://github.com/TabbyML/tabby
bolt Snapshot: commit 21b2904
science engine v1.21
schedule 2026-07-17T14:16:17.894311+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

App Privacy Score

97 /100
Low privacy risk

Low risk · 9 finding(s)

Dependency score: 100 (Low risk)

bar_chart Score Breakdown

env_fs −3

list Scan Summary

0 high 0 medium 9 low
First-party packages: 1
Dependency packages: 0
Ecosystem: java

swap_horiz External domains

::ffff:192.168.0.1api.github.comapi.github.yourcompany.comapp.posthog.comapp.tabbyml.comblog.ganssle.iobrotlipy.readthedocs.iocdn.jsdelivr.netchevrotain.iocode.visualstudio.comcommonmark.orgdata.iana.orgdatatracker.ietf.orgdate-fns.orgdeveloper.mozilla.orgdocs.npmjs.comdocs.oracle.comdocs.python.orgen.wikipedia.orgfloating-ui.comfonts.googleapis.comgithub.comgitlab.comgitlab.yourcompany.comhttpbin.orgi.ibb.coimg.shields.iojslib.k6.iojson-schema.orglegacy.reactjs.orglinks.tabbyml.commarketplace.visualstudio.commetacpan.orgmomentjs.commüller.denpmjs.comnpms.ioother.compds-rings.seti.orgplayground.app.tabbyml.complugins.jetbrains.composthog.comradix-ui.comreact-resizable-panels-au2wmqbbr-brian-vaughns-projects.vercel.appreact-resizable-panels-ca7gk2gh5-brian-vaughns-projects.vercel.appreact-resizable-panels.vercel.appreact-virtualized-auto-sizer.vercel.appreact.devreactjs.orgs2.googleusercontent.comsentry.iostackoverflow.comstatic.scarf.shtabby.tabbyml.comtally.sotools.ietf.orgunpkg.comuptime.tabbyml.comus.i.posthog.comus.posthog.comwww.cl.cam.ac.ukwww.egenix.comwww.figma.comwww.framer.comwww.freebsd.orgwww.gmarts.orgwww.gnu.orgwww.iana.orgwww.rfc-editor.orgwww.tabbyml.comwww.tondering.dkwww.w3.orgxn--fiqs8s.icom.museumyarnpkg.com

</> First-Party Code

first-party (npm): clients/eclipse

java first-party
expand_more 9 low-confidence finding(s)
low env_fs production #b795de1a2ac658e8 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Logger.java:7 
	private static String TABBY4ECLIPSE_LOG_DEBUG = System.getenv("TABBY4ECLIPSE_LOG_DEBUG");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #d35e284fa55aefbd — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/Utils.java:5 
		return System.getProperty("os.name").toLowerCase().contains("win");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #8618a7dd06bea26a — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:12 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1c27c8697623d7f5 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/renderer/InlineCompletionItemRenderer.java:17 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2 = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_RENDERER_TEXTPAINTER2");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7af11e29b3c8251c — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:12 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_BASICINPUT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fca638fba3fd2c51 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:17 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_DEBOUNCEDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c81beffe34601b8f — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/inlineCompletion/trigger/InlineCompletionTrigger.java:22 
	private static String TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT = System
			.getenv("TABBY4ECLIPSE_EXPERIMENTAL_TRIGGER_PAIREDDOCUMENT");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #5a88ac5a1be29e28 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:38 
				String nodePath = nodePathFromPreference.replaceFirst("~", System.getProperty("user.home"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ee4f0770cbbf7490 — Environment-variable access.
repo/clients/eclipse/plugin/src/com/tabbyml/tabby4eclipse/lsp/ConnectionProvider.java:49 
				String systemPath = System.getenv("PATH");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • @codemirror/language prod — dist-only: no readable source
  • @codemirror/search prod — dist-only: no readable source
  • @codemirror/state prod — dist-only: no readable source
  • @codemirror/view prod — dist-only: no readable source
  • @curvenote/ansi-to-react prod — dist-only: no readable source
  • @urql/core prod — dist-only: no readable source
  • @urql/exchange-auth prod — dist-only: no readable source
  • @urql/exchange-graphcache prod — dist-only: no readable source
  • hast prod — no javascript source
  • mdast prod — no javascript source
  • next prod — tarball exceeds byte cap
  • sonner prod — dist-only: no readable source
  • swr prod — dist-only: no readable source
  • tabby-common prod — cdn 403
  • tabby-download prod — cdn 403
  • tabby-inference prod — cdn 403
  • tantivy prod — cdn 403
  • http-api-bindings prod — cdn 403
  • llama-cpp-server prod — cdn 403
  • tabby-webserver prod — cdn 403
  • hash-ids prod — cdn 403
  • aim-downloader prod — cdn 403
  • tabby-git prod — cdn 403
  • tree-sitter-scala prod — no rust source in crate
  • tree-sitter-python prod — no rust source in crate
  • tree-sitter-java prod — no rust source in crate
  • tree-sitter-kotlin prod — no rust source in crate
  • tree-sitter-rust prod — no rust source in crate
  • tree-sitter-typescript prod — no rust source in crate
  • tree-sitter-go prod — no rust source in crate
  • tree-sitter-ruby prod — no rust source in crate
  • tree-sitter-c prod — no rust source in crate
  • tree-sitter-cpp prod — no rust source in crate
  • tree-sitter-c-sharp prod — no rust source in crate
  • tree-sitter-solidity prod — no rust source in crate
  • tree-sitter-lua prod — no rust source in crate
  • tree-sitter-elixir prod — no rust source in crate
  • tree-sitter-gdscript prod — cdn 403
  • ollama-api-bindings prod — cdn 403
  • tabby-index prod — cdn 403
  • tabby-schema prod — cdn 403
  • tabby-db prod — cdn 403
  • tabby-crawler prod — scan budget exceeded
  • octocrab prod — scan budget exceeded
  • fs_extra prod — scan budget exceeded
  • gitlab prod — scan budget exceeded
  • cron prod — scan budget exceeded
  • ratelimit prod — scan budget exceeded
  • cached prod — scan budget exceeded
  • openidconnect prod — scan budget exceeded
  • tabby-db-macros prod — scan budget exceeded
  • sql_query_builder prod — scan budget exceeded
  • sqlx-migrate-validate prod — scan budget exceeded
  • quote prod — scan budget exceeded
  • syn prod — scan budget exceeded
  • base64 prod — scan budget exceeded
  • org.eclipse.lsp4j:org.eclipse.lsp4j prod — scan budget exceeded
  • io.github.z4kn4fein:semver prod — scan budget exceeded