TavernKeeper Advisory reports for Tavernary

Tavernary security context

Technical security reports for Tavernary projects.

TavernKeeper examines one exact repository commit and publishes the evidence and limitations of that review. It helps inform Tavernary's project assessment; it does not certify that software is safe.

A completed report explains what was examined, what required attention, and what the process cannot know.

Reports

Search the current preferred report for each scanned repository. Earlier scans remain available through repository history.

424 reports shown

How it works

The process is exact-commit, complete-or-nothing, and designed to keep untrusted project code from becoming executable.

  1. Pin the target. Tavernary supplies an eligible GitHub repository identity and exact commit.
  2. Inspect without executing. TavernKeeper inventories the checkout and runs required deterministic scanners against it as data.
  3. Review candidate context. Bounded candidate context is sent to the named configured model provider under a strict response schema.
  4. Validate and publish. Complete evidence and review coverage is validated before a sanitized immutable report is published.

External scanners

TavernKeeper uses version-pinned, purpose-built scanners from established open-source projects. Each tool covers a different evidence source; applicable scanners run only when the exact commit contains the inputs they understand.

Gitleaks

What it checks. Searches source and repository history for exposed secrets and credential-like values.

How TavernKeeper uses it. TavernKeeper runs the pinned scanner against the exact commit and its bounded history as untrusted data.

OpenGrep

What it checks. Applies static-analysis rules to code to find security issues and suspicious patterns.

How TavernKeeper uses it. TavernKeeper runs the pinned engine with its review policy against the exact checkout without executing project code.

OSV-Scanner

What it checks. Checks declared dependency inputs against known vulnerability advisories from the OSV ecosystem.

How TavernKeeper uses it. TavernKeeper applies it when the inventory contains supported dependency manifests, then records the advisory evidence for review.

zizmor

What it checks. Performs static analysis for security problems in GitHub Actions workflows.

How TavernKeeper uses it. TavernKeeper applies it to workflow files found in the exact commit, keeping workflow findings tied to that revision.

malcontent

What it checks. Looks for signals associated with supply-chain attacks and suspicious behavior in project artifacts.

How TavernKeeper uses it. TavernKeeper applies it to eligible artifacts from the exact checkout and reports its results as candidates for contextual review.

What TavernKeeper does

TavernKeeper treats the checkout as untrusted data. It inventories the exact commit, runs required deterministic scanners, and sends bounded candidate context to the named configured model provider for structured contextual assessment.

What TavernKeeper never does

It does not run dependencies, scripts, builds, tests, Actions, or target executables. Incomplete scanner, review, evidence, or publication coverage produces no report.