A scanner flagged some text-matching patterns as potentially slow. These patterns only parse short color strings that the browser itself formats, so in practice they cannot be made to hang the app by any outside party.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged expressions are anchored color-parsing regular expressions applied to strings produced by the browser's computed-style resolution of a color value. Inputs are short, browser-normalized color strings rather than arbitrary attacker-controlled text, and the patterns are linear with bounded alternations, so no catastrophic backtracking path is demonstrated. At worst, unusual input could cause a brief tab slowdown, which is a recoverable local performance issue only.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
The code downloads saved color themes from the app's own server and applies those colors to the interface. Although a scanner linked the download with dynamic code patterns, the downloaded data is only used to set colors, never run as code. This is exactly what a theme feature is supposed to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The network retrieval in this file is a same-origin request to the SillyTavern settings endpoint, using the host's own request headers, to look up a saved theme by name. The response is used only to copy color strings into CSS custom properties and attribute values on color picker elements. The correlated 'execution sink' is dynamic property assignment such as the event-dispatch override on a picker element and timer-based reapplication, not evaluation of retrieved content. Retrieved theme values are never passed to script evaluation, HTML construction, or code generation, and the monkey-patched fetch wrapper only appends locally computed color keys to the host's own theme-save requests. This behavior matches the project's stated theme-integration purpose and stays within the host origin.
A scanner thought this code might be deliberately scrambled to hide what it does, but the actual code is plainly written and does exactly what a layout settings panel should do: build checkboxes, dialogs, and color pickers, and save the user's choices. Nothing is hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The flagged file is a plain, readable settings panel for a layout extension. The visible source contains ordinary DOM construction, checkbox handlers, validated user inputs (a CSS-unit regex and a bounded numeric multiplier), local settings persistence, and same-host script loading for a color picker component. There is no minified, packed, or otherwise obfuscated code, no encoded strings, no hidden control flow, and no external data destinations. The scanner flag carries low confidence and no retained matched literal, and the supplied source contradicts any obfuscation conclusion.
A secret-scanning tool thought it saw an API key on this line, but the line is just a normal code comparison for a settings toggle. There is no password or key anywhere in this file.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The credential-pattern match falls on a conditional statement comparing a settings key string as part of a checkbox handler; the surrounding code contains no secret material of any kind. No API keys, tokens, or credentials are assigned, transmitted, or stored anywhere in the supplied source. The match is a pattern false positive on ordinary identifier text, and a same-text correlation does not demonstrate exposure of usable credentials.