A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The code fetches saved theme information from the user's own SillyTavern server and uses it only to set colors in the interface. Nothing downloaded is ever run as code. The other unusual-looking pieces are just ways to keep the extension's color settings in sync with SillyTavern's own theme system.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The correlation pairs a network call with an apparent execution sink, but the supplied source shows no download-to-execution chain. The network primitive is a fetch to the SillyTavern host's own settings endpoint using the host's request-header helper, used to read saved theme definitions; the response is consumed only as color strings that are applied to CSS properties and pickers. The presumed 'sink' is a temporary per-instance override of a DOM element's event-dispatch method to suppress change events while programmatically setting a picker color, plus an innerHTML assignment that writes the extension's own theme CSS rules back into SillyTavern's existing custom-CSS element. Neither evaluates network-retrieved content as code. The file also monkey-patches window.fetch to intercept theme-save requests and attach its theme-color keys to the outgoing body, which is disclosed, local to the host, and proportionate to the stated theme-integration purpose.
A scanner flagged some pattern-matching code as potentially slow, but the patterns only run on tiny, browser-generated color strings. There is no realistic way for anyone to make this code slow down or misbehave.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged expressions are small, anchored regular expressions that parse CSS color strings produced by the browser's computed-style API. Their inputs are short, browser-formatted color values, not attacker-controlled data of arbitrary length, so the theoretical super-linear backtracking the scanner warns about cannot be triggered in practice. The matched values are used solely to convert colors to hexadecimal picker values. No denial-of-service path, untrusted input flow, or other concrete harm is demonstrated.
A scanner thought the code looked suspiciously scrambled, but the actual code is completely readable and just builds the extension's settings screen — checkboxes, color pickers, and support links. There is nothing hidden or disguised here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The flagged file is plainly written, human-readable JavaScript that builds a settings panel for a UI-layout extension: DOM construction via a helper, checkbox and dropdown handlers, a color-picker custom element, and links to the project's own support pages. There are no encoded strings, packed payloads, hex or base64 blobs, eval-style indirection, or any other obfuscation technique. The scanner signal (reported with low scanner confidence and no retained matched literals) does not correspond to any concealment in the supplied source. The one script injection point loads a local color-picker library from the host's own lib path, consistent with the extension's stated theming purpose. No hidden execution, external destinations, or credential handling is present.
A secret-scanning tool mistook the name of an internal setting (a word that looks like a code) for an API key. The line is just a settings checkbox comparing against that name — there is no actual secret in the code.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is a plain string comparison against an internal settings key name that happens to match a generic API-key character pattern. The surrounding code is a checkbox change handler for a layout toggle; the string is a configuration key, not a credential. No secret-like value exists on the line or anywhere in the supplied source: the file contains no API keys, tokens, or passwords, and it performs no credential handling at all. This is a false positive from a pattern-based secret scanner.