TavernKeeper Scan Report

envy-ai/ai_rpg

Commit bea1dd1 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 8 low

What this review found

No material or immediate-danger item was identified.

Expected scanner matches (5)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is part of the official Vaadin web component library bundled with the project. It only runs special diagnostic code when the app is running locally in development mode, and the relevant statistics function is empty in this build. It is not a security threat.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The matched dynamic execution is inside Vaadin's development-mode detector in a vendored bundle. The function uncommentAndRun extracts commented-out code from a callback's source and compiles it via new Function, but only executes when window.Vaadin.developmentMode is true. That flag is gated by localhost checks, forced-development-mode localStorage, and production-mode settings. The only callback passed in this build is maybeGatherAndSendStats, which is an empty function. This is a standard, well-known Vaadin library pattern and does not introduce attacker-controlled input or exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
vendored
Source
public/vendor/vaadin.js:11281

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

This is a test script checking whether a local server has started up. It sends a simple 'are you ready?' request with no sensitive information attached. There is no credential theft here.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.

Contextual assessment: The flagged line is a GET request to a health-check endpoint inside a Playwright end-to-end test script. The request carries no credentials, headers, or body; it simply polls a local server for readiness. The scanner likely correlated process.env usage (passed to a spawned child server at a nearby line) with this network call, but the two are unrelated: the environment is forwarded to a local child process for test setup, and the fetch is a parameterless health probe to a localhost URL.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role
production
Source
playwright_scripts/test_new_game_end_to_end.js:117

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a standard piece of bundled third-party library code used to find the global JavaScript object. It does not run any user or network input, only fixed internal text, so it is not a security risk.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The matched line is inside a vendored webpack bundle for Nunjucks. It is the standard webpack global-object shim that resolves a reference to the global scope by trying Function('return this')() and (1,eval)('this') with static string literals. No user-controlled or remote data is passed to eval; the operands are constant strings used solely to obtain the global reference. This is a common, benign pattern in bundled JavaScript libraries.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
vendored
Source
public/vendor/nunjucks.js:4848

Credential access and network transmission in one file

Expected behavior · high confidence

The test file both starts a local server (passing along environment variables) and makes a simple network request to check if that server is ready. These are normal test activities and are not connected in a way that would leak secrets.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The rule flags co-occurrence of a credential source and a network sink in the same file. Here the credential-adjacent code is the forwarding of process.env to a spawned local server process for test orchestration, and the network sink is a GET health-check fetch to a localhost URL. No credentials are extracted, read, or transmitted to the network sink. The two data flows are independent and serve the legitimate purpose of starting and verifying a local test server.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 3
Rule
credential-exfiltration
File role
production
Source
playwright_scripts/test_new_game_end_to_end.js:117

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is part of a standard third-party template engine called Nunjucks. Template engines convert text templates into runnable code so they can render pages quickly. Using dynamic code generation is how this library is designed to work. There is no sign of anything unusual or malicious here.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The matched line is inside a vendored copy of the Nunjucks templating engine. The `new Function(source)` call is Nunjucks' standard template compilation mechanism: it compiles a template string into a JavaScript render function at runtime. This is the documented and expected behavior of the library. The source passed to `new Function` is generated by Nunjucks' own compiler from template text, not from arbitrary external input. The file role is vendored and the code matches the upstream library's known implementation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
vendored
Source
public/vendor/nunjucks.js:2806

Related contextual observations

Environment forwarding to spawned test server is standard test setup

low risk · high confidence

When running automated tests, the script starts a copy of the app on the same machine and passes along normal environment settings. This is expected and does not send any secrets anywhere outside the local test environment.

Technical assessment

The test script spawns the project server with the full process.env plus a color override. This is the conventional way to launch a local server for integration testing and does not constitute credential exfiltration. The environment variables are consumed by the local child process, not transmitted to an external endpoint.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Webpack global object shim uses static eval

low risk · high confidence

The library uses a common trick to find the global JavaScript environment. Because it only uses fixed internal text and never user content, it is safe.

Technical assessment

The module at webpack module id 14 resolves the global object by first using a closure return of this, then falling back to Function('return this')() and (1,eval)('this'). Both eval-style calls use constant string literals and do not incorporate external input, so there is no injection surface.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Vaadin development-mode statistics collection is disabled

low risk · high confidence

The Vaadin usage statistics feature that normally accompanies this code path has been emptied out, so no data is collected or sent.

Technical assessment

The maybeGatherAndSendStats function is defined as an empty body, and usageStatistics only invokes it through runIfDevelopmentMode, which is gated by the development-mode flag. No network or telemetry behavior is present in this build.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity