TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

NeoTavern/NeoTavern-Frontend

Commit a0d833c Reviewed

20 material concerns identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 20 material 55 low

What this review found

Dependency advisory GHSA-p9ff-h696-f583 applies

Material concern · low confidence

The scanner reports a serious issue in a dependency, but the supplied evidence does not identify the package or show whether the risky code can be reached.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-p9ff-h696-f583 to a dependency declared by this repository.

Contextual assessment: This is metadata for a high-severity advisory only. The affected dependency, installed version, vulnerable component, runtime reachability, attacker-controlled input, and concrete impact are absent, so the finding cannot be validated contextually.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-p9ff-h696-f583
File role
production
Source
package-lock.json

Dependency advisory GHSA-v6wh-96g9-6wx3 applies

Material concern · low confidence

The scanner reports a dependency problem, but there is not enough information to tell whether it affects users in practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.

Contextual assessment: Only a medium-severity advisory identifier is supplied. No package, version, affected code path, attacker input, or resulting harm is available for contextual assessment.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v6wh-96g9-6wx3
File role
production
Source
package-lock.json

Dependency advisory GHSA-jr45-8vmc-qm54 applies

Material concern · low confidence

A scanner found a possible dependency weakness, but the evidence does not show what it is or whether the application uses the affected behavior.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-jr45-8vmc-qm54 to a dependency declared by this repository.

Contextual assessment: The candidate contains only an advisory reference and scanner severity. Package identity, shipped version, runtime reachability, controllable input, and exploit consequences are unavailable.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-jr45-8vmc-qm54
File role
production
Source
package-lock.json

Dependency advisory GHSA-pm4m-ph32-ghv5 applies

Material concern · low confidence

The scanner flags a high-severity dependency issue, but the supplied information cannot establish whether users are exposed.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-pm4m-ph32-ghv5 to a dependency declared by this repository.

Contextual assessment: The high scanner rating is not sufficient to establish impact. The affected dependency and version, vulnerable functionality, runtime reachability, attacker control, and concrete harm are omitted.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-pm4m-ph32-ghv5
File role
production
Source
package-lock.json

Dependency advisory GHSA-55q2-fjhq-7xh7 applies

Material concern · low confidence

A possible dependency weakness was reported, but no details show whether it can affect this frontend.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-55q2-fjhq-7xh7 to a dependency declared by this repository.

Contextual assessment: Only the advisory identifier and medium scanner severity are supplied. There is no evidence of affected package version, reachable vulnerable code, attacker-controlled data, or user impact.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-55q2-fjhq-7xh7
File role
production
Source
package-lock.json

Dependency advisory GHSA-v2hh-gcrm-f6hx applies

Material concern · low confidence

The scanner reports a high-severity issue in a dependency, but the evidence is too incomplete to determine real exposure.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2hh-gcrm-f6hx to a dependency declared by this repository.

Contextual assessment: No package name, installed version, vulnerable behavior, runtime path, attacker input, or concrete consequence is provided; scanner severity alone cannot establish an immediate danger.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v2hh-gcrm-f6hx
File role
production
Source
package-lock.json

Dependency advisory GHSA-8xcm-r25x-g524 applies

Material concern · low confidence

The scanner found a possible medium-severity dependency issue, but there is no evidence explaining whether it affects actual use.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.

Contextual assessment: The supplied record lacks dependency identity, resolved version, advisory mechanics, reachable code path, attacker-controlled input, and impact; contextual validation is not possible.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8xcm-r25x-g524
File role
production
Source
package-lock.json

Dependency advisory GHSA-4w7w-66w2-5vf9 applies

Material concern · low confidence

A dependency warning was generated, but the supplied evidence does not identify a practical risk to users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.

Contextual assessment: Only a medium-severity advisory reference is available. The package, shipped version, vulnerable operation, runtime reachability, controllable input, and concrete harm are not shown.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, installed version, advisory details, reachability, and fixed version before remediation is prioritized.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4w7w-66w2-5vf9
File role
production
Source
package-lock.json

Dependency advisory GHSA-4c8g-83qw-93j6 applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4c8g-83qw-93j6 to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4c8g-83qw-93j6
File role
production
Source
package-lock.json

Dependency advisory GHSA-5p4m-2wfm-xmqj applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5p4m-2wfm-xmqj to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-5p4m-2wfm-xmqj
File role
production
Source
package-lock.json

Dependency advisory GHSA-v2wj-q39q-566r applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v2wj-q39q-566r to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v2wj-q39q-566r
File role
production
Source
package-lock.json

Dependency advisory GHSA-4cwx-7wf7-3272 applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4cwx-7wf7-3272 to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4cwx-7wf7-3272
File role
production
Source
package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
package-lock.json

Dependency findings lack the records needed for contextual validation

material risk · low confidence

The report shows eight dependency alerts, but removes the package names and versions. Without those details, the actual user risk cannot be determined.

Technical assessment

The evidence is a production lockfile with scanner advisory identifiers, but package details were explicitly removed and the shown excerpt does not include resolved package records. Dependency-version matching, runtime reachability, attacker-input flow, and concrete impact therefore remain unassessed.

Impact: medium · Exploitability: plausible

Developer action: Supply the complete lockfile dependency records and advisory details, including affected and fixed versions, vulnerable functions, reachability, and attacker-input requirements.

Sources:

Dependency advisory GHSA-mh99-v99m-4gvg applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mh99-v99m-4gvg
File role
production
Source
package-lock.json

Dependency advisory GHSA-8r6m-32jq-jx6q applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8r6m-32jq-jx6q to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8r6m-32jq-jx6q
File role
production
Source
package-lock.json

Dependency advisory GHSA-m8rv-5g2x-5cg5 applies

Material concern · low confidence

A scanner found a known issue in an unspecified installed library, but the available evidence does not show what the library does or whether the issue can affect users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, affected component, runtime reachability, attacker-controlled input, and concrete impact were removed. The finding cannot be reduced to expected behavior from this evidence alone.

Impact: medium · Exploitability: plausible

Developer action: Provide the affected package, resolved version, advisory details, and runtime reachability so remediation can be assessed.

Scanner
osv-scanner 2.4.0
Rule
GHSA-m8rv-5g2x-5cg5
File role
production
Source
package-lock.json

Dependency advisory GHSA-2v37-7h3g-55p8 applies

Material concern · low confidence

A dependency was matched to a published security advisory, but the supplied evidence does not identify which package is affected or whether the vulnerable behavior can be reached.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-2v37-7h3g-55p8 to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, runtime reachability, attacker-controlled input, and concrete impact are omitted. The advisory cannot be fully contextualized from the supplied evidence, so immediate danger is not established, but remediation analysis is warranted.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, determine runtime reachability and attacker-controlled input, then update or pin the dependency if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-2v37-7h3g-55p8
File role
production
Source
package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Material concern · low confidence

A dependency was matched to a published security advisory, but the supplied evidence does not identify which package is affected or whether the vulnerable behavior can be reached.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, runtime reachability, attacker-controlled input, and concrete impact are omitted. The advisory cannot be fully contextualized from the supplied evidence, so immediate danger is not established, but remediation analysis is warranted.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, determine runtime reachability and attacker-controlled input, then update or pin the dependency if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rgw5-rvv9-x895
File role
production
Source
package-lock.json

Dependency advisory GHSA-fx2h-pf6j-xcff applies

Material concern · low confidence

A dependency was matched to a published security advisory, but the supplied evidence does not identify which package is affected or whether the vulnerable behavior can be reached.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.

Contextual assessment: The scanner reports an advisory match in the production lockfile, but package identity, resolved version, vulnerable range, runtime reachability, attacker-controlled input, and concrete impact are omitted. The advisory cannot be fully contextualized from the supplied evidence, so immediate danger is not established, but remediation analysis is warranted.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, determine runtime reachability and attacker-controlled input, then update or pin the dependency if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fx2h-pf6j-xcff
File role
production
Source
package-lock.json

Minor cautions

Dependency advisory GHSA-3jxr-9vmj-r5cp applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-3jxr-9vmj-r5cp
File role
production
Source
package-lock.json

Dependency advisory GHSA-v56q-mh7h-f735 applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v56q-mh7h-f735 to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v56q-mh7h-f735
File role
production
Source
package-lock.json

Dependency advisory GHSA-7p8r-x3mc-p8w7 applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-7p8r-x3mc-p8w7 to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-7p8r-x3mc-p8w7
File role
production
Source
package-lock.json

Dependency advisory GHSA-c2j3-45gr-mqc4 applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2j3-45gr-mqc4 to a dependency declared by this repository.

Contextual assessment: The scanner reports a low-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: low · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-c2j3-45gr-mqc4
File role
production
Source
package-lock.json

Dependency advisory GHSA-28wg-ghj8-5hjv applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-28wg-ghj8-5hjv to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-28wg-ghj8-5hjv
File role
production
Source
package-lock.json

JavaScript analysis reported javascript.xray.unsafe-command

Minor caution · high confidence

This tooling file runs the project's build command through the operating system shell. That is normal for a build helper, but shell mode can make command handling more dependent on the surrounding environment.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-command in this repository.

Contextual assessment: The file synchronously invokes a fixed package-manager build command with inherited environment variables and inherited standard streams. Shell execution increases exposure to platform-specific shell interpretation and command resolution, but the command and arguments shown are static; no user-controlled input or external destination is evidenced. This supports a minor hardening concern, not a material vulnerability or malicious behavior finding.

Impact: low · Exploitability: plausible

Developer action: Consider removing shell mode unless shell features are required, and ensure the build script and package lifecycle hooks are reviewed separately.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-command
File role
tooling
Source
scripts/build-profile.js:8-12

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
package-lock.json

Dependency advisory GHSA-xvcm-6775-5m9r applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xvcm-6775-5m9r to a dependency declared by this repository.

Contextual assessment: The scanner reports a high-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xvcm-6775-5m9r
File role
production
Source
package-lock.json

Dependency advisory GHSA-v3r7-h72x-cjcm applies

Minor caution · low confidence

A dependency was flagged by a vulnerability database, but the supplied evidence does not say which package or whether the risky code is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.

Contextual assessment: The scanner reports a medium-severity advisory for a declared production dependency, but package identity, installed version, vulnerable range, reachability, attacker-controlled input, and concrete impact are absent.

Impact: medium · Exploitability: plausible

Developer action: Identify the affected package and installed version, confirm runtime reachability and advisory applicability, then upgrade or apply the vendor fix if applicable.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v3r7-h72x-cjcm
File role
production
Source
package-lock.json
Expected scanner matches (46)

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads a named environment setting so the launcher can configure its application port.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The supplied context shows process environment variables being read for documented launcher configuration. No serialization or outbound transmission is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:121

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads selected environment settings so users can configure its ports, backend, and authentication. The supplied code does not show those values being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The flagged operation is environment-variable access during configuration loading. Values are assigned to local runtime configuration and no exfiltration destination or transmission is shown in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:113

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads an environment setting to choose the launcher host address.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The shown code maps a named environment variable to application host configuration; the evidence does not show credential handling or exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:117

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This is a local development proxy for background resources, matching the frontend’s stated architecture.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged configuration routes a frontend resource prefix to the local application backend during development. It uses a loopback destination and does not show credential collection, external transmission, hidden execution, or persistence. The scanner’s generic link signal is therefore consistent with ordinary frontend-backend integration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:36

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher places its own configuration values into environment variables for the processes it starts. The supplied evidence does not show those values being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The flagged assignments serialize configured launcher state into process.env before starting the internal backend. This is consistent with passing runtime configuration to a child process, with no external destination or credential exfiltration shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:353

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This match is only a CSS styling block for profile controls; it does not establish startup behavior or persistence.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The supplied context places the match within the component's scoped stylesheet. No startup hook, storage write, process execution, or persistence mechanism is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:473

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads a setting for the internal backend port, which is needed to start the bundled backend.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The context shows a named environment override parsed into internal backend port configuration, consistent with the launcher purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:123

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads an environment setting to choose a build profile; it does not show secrets being collected or sent anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The cited line checks process environment variables for build-mode selection. The supplied context shows no serialization of the environment, credential access, or network transmission associated with this signal.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
tooling
Source
vite.config.ts:79

JavaScript analysis reported javascript.xray.unsafe-command

Expected behavior · high confidence

The launcher runs a fixed version-control query to identify the current application revision. This does not execute user-provided text or send data to an external service.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-command in this repository.

Contextual assessment: The flagged operation invokes a fixed command with a fixed working directory and only reads the resulting revision identifier. No attacker-controlled command string or sensitive output flow is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-command
File role
production
Source
launcher.js:162

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The script passes the existing environment to the build command so normal build settings and credentials remain available locally. The supplied code does not send that information anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The environment object is derived from the process environment and adds a build marker, then is supplied to a local build invocation. No destination other than the child process is shown, and no environment value is serialized or transmitted by this file. The scanner signal is therefore contextualized as build-tool behavior rather than credential theft evidence in this artifact. Developer action is none because this is proportionate to the tooling role; review build scripts invoked by the child process separately if needed.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
tooling
Source
scripts/build-profile.js:4

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This forwards character-related requests to the local backend, which is expected for this frontend.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged entry is a development proxy for character data and targets the local backend. The supplied source shows no remote host, secret handling, obfuscation, or unrelated data transfer. This behavior is proportionate to a frontend designed to operate with a SillyTavern-compatible backend.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:35

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher passes its configured application port to the backend process so the components can communicate.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The application port is converted to text and assigned to a named environment variable during startup. This is ordinary child-process configuration and does not itself disclose secrets.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:352

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This local proxy supports persona requests between the frontend and backend.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The matched configuration forwards persona requests to a loopback backend during development. That is a direct implementation of the application’s frontend/backend design. No external destination, credential exposure, concealed execution, or persistent behavior is evidenced.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:33

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads a password from an environment variable so it can configure local authentication. The supplied evidence does not show the password being uploaded or disclosed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The value is assigned to local configuration during startup. The provided context shows no serialization to a remote destination, logging, or other exfiltration path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:137

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This match is only CSS layout code for the settings panel and does not make the application start automatically.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The cited line is in a scoped style section and defines visual layout properties only. It provides no evidence of startup modification or executable persistence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:458

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads selected environment settings so users can configure its ports, backend, and authentication. The supplied code does not show those values being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The flagged operation is environment-variable access during configuration loading. Values are assigned to local runtime configuration and no exfiltration destination or transmission is shown in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:114

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This match is a visual styling rule for the profile content area, not a mechanism that changes startup behavior.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The supplied source context shows the candidate inside a Vue scoped stylesheet with display, spacing, padding, background, and border declarations. No persistence operation is evidenced.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:479

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This forwards ordinary API calls to the local backend and is expected application plumbing.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged entry proxies the application API to a local backend and enables origin adjustment for that connection. The supplied evidence does not show forwarding to an internet service or extracting sensitive values. The behavior is consistent with the documented all-in-one local deployment.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:34

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads an environment setting to select an external backend address.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The shown assignment configures the documented external-backend mode. No secret value or transmission destination is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:119

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

The launcher uses network-related configuration as part of connecting the frontend to its intended backend. The scanner label alone does not show an unsafe destination or hidden transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only scanner metadata is supplied for the flagged link signal. The available source context shows documented backend repositories and configurable backend URLs, consistent with the launcher purpose, without evidence of credential transmission.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
launcher.js:31

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The flagged text only adds the package version to generated type-file comments during the build. It does not send information anywhere or access user credentials.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The candidate is a template interpolation of the build-time npm package-version environment value within a documentation comment supplied to the type declaration writer. The evidence shows no network destination, persistence, runtime execution, credential handling, or serialization of broader process state. The scanner signal is therefore consistent with ordinary build metadata generation rather than credential theft or environment exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
vite.config.types.ts:18

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads selected environment settings so users can configure its ports, backend, and authentication. The supplied code does not show those values being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The flagged operation is environment-variable access during configuration loading. Values are assigned to local runtime configuration and no exfiltration destination or transmission is shown in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:110

Gitleaks reported generic-api-key

Expected behavior · high confidence

The flagged value is part of the interface definition for entering an AI provider key. It is not shown as a hard-coded secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched line declares a key-manager widget associated with a provider-specific secret-key identifier. The supplied source shows configuration metadata, not a credential value, transmission, logging, or exfiltration path. This is consistent with a frontend that supports user-supplied model-provider credentials; the removed match prevents independent validation of the exact token-like text, but the surrounding structure strongly indicates a secret-field declaration rather than embedded credential exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
src/api-connection-definition.ts:169

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher passes the internal backend port to the backend it starts. This is needed for normal operation.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The internal backend port is serialized into a process environment variable before spawning the backend. The shown flow has no network transmission or unrelated data collection.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:351

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher tells the backend whether it should use the internally managed backend. This is a normal startup setting.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: A boolean configuration value is converted to text and exposed to the child backend through process.env. This is proportionate to the launcher’s all-in-one backend-management purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:354

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · medium confidence

The launcher uses network-related configuration as part of connecting the frontend to its intended backend. The scanner label alone does not show an unsafe destination or hidden transmission.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: Only scanner metadata is supplied for the flagged link signal. The available source context shows documented backend repositories and configurable backend URLs, consistent with the launcher purpose, without evidence of credential transmission.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
production
Source
launcher.js:34

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is part of the visual styling for an NPC profile row. It does not show the application changing startup settings or creating persistence.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The supplied source context places the match in a stylesheet rule defining flex layout, spacing, and font size. No startup hook, filesystem write, scheduled task, service registration, or other persistence operation is present in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/mythic-agents/components/NpcTab.vue:304

JavaScript analysis reported javascript.xray.unsafe-command

Expected behavior · high confidence

The launcher starts the local backend with a fixed program and fixed script name. The evidence does not show user input being inserted into a command.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-command in this repository.

Contextual assessment: The process creation uses a fixed executable and fixed argument array, with a configured working directory and piped output. Although process spawning is powerful, the supplied flow does not demonstrate shell interpretation or attacker-controlled command construction.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-command
File role
production
Source
launcher.js:362-365

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads a setting controlling whether the bundled backend is used.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The environment override directly controls the documented internal-backend mode and does not itself expose data.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:116

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This local proxy handles CSRF-token requests needed by the frontend and backend.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The matched configuration routes CSRF-token requests to the loopback backend. Such routing is normal when a browser frontend and local server are developed on separate ports. The evidence shows no external destination, token disclosure, or suspicious transformation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:32

Gitleaks reported generic-api-key

Expected behavior · high confidence

The flagged text is a reference to a named provider secret used by the interface's API-key manager, not an exposed key value.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched line defines a provider configuration item with a key-manager widget and a constant identifying which secret to manage. The supplied evidence shows no literal credential, transmission, logging, or external destination; the pattern is a false positive caused by credential-related configuration terminology.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
src/api-connection-definition.ts:169

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This forwards thumbnail requests to the local backend for display in the frontend.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The flagged entry is a loopback proxy for thumbnail resources. It is directly related to rendering backend-hosted media and contains no evidence of remote collection, credential use, hidden execution, or persistence. The generic network-access finding is expected in this context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:37

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads selected environment settings so users can configure its ports, backend, and authentication. The supplied code does not show those values being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The flagged operation is environment-variable access during configuration loading. Values are assigned to local runtime configuration and no exfiltration destination or transmission is shown in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:111

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged network settings send the frontend's normal local API requests to its local backend, which matches the application's design.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The proxy configuration routes application paths to a local backend and rewrites one login-check path. This is consistent with a frontend/backend development setup; no external destination or credential exfiltration is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:40

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged section only controls the visual layout of a profile-selection area. It does not start programs, change startup settings, or create persistence.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The supplied source context shows a stylesheet rule defining borders, spacing, and layout for the profile section. No persistence mechanism, startup modification, execution, or data flow is present in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/chat-memory/MemoryPopup.vue:109

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher passes the selected external backend address to the backend process so external-backend mode can work.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The configured external backend URL is assigned to a named environment variable for the managed backend. The surrounding code also uses that configured endpoint as the intended proxy target; no unrelated destination or covert transmission is shown.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:355

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

This forwards user-related requests to the local backend so the frontend can function.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.

Contextual assessment: The matched configuration proxies user requests to the local backend. Although user data may pass through this route as part of normal application operation, the destination is loopback and no unrelated disclosure or external transmission is shown. This is proportionate to the stated frontend purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.shady-link
File role
tooling
Source
vite.config.ts:38

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads a setting controlling automatic backend updates.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The context shows a boolean configuration override for an explicitly documented auto-update feature. Update behavior itself is not shown here.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:120

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads a local backend-path setting from an environment variable to select the intended SillyTavern installation. No credential theft or external transmission is shown.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The value is used as local configuration for backend path resolution. The supplied evidence does not demonstrate serialization to a network destination or use as a secret-bearing payload.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:124

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads selected environment settings so users can configure its ports, backend, and authentication. The supplied code does not show those values being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The flagged operation is environment-variable access during configuration loading. Values are assigned to local runtime configuration and no exfiltration destination or transmission is shown in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:115

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads selected environment settings so users can configure its ports, backend, and authentication. The supplied code does not show those values being sent elsewhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The flagged operation is environment-variable access during configuration loading. Values are assigned to local runtime configuration and no exfiltration destination or transmission is shown in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:112

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads a setting controlling whether the internal backend is exposed.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The shown environment override controls a documented exposure option; no network binding or authorization outcome is included in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:118

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This match is only CSS for arranging profile controls and does not alter what runs when the application starts.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.

Contextual assessment: The cited line is within a stylesheet and contains visual flexbox layout declarations. The evidence does not show startup registration, file modification, or any persistence action.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
src/extensions/built-in/model-randomizer/SettingsPanel.vue:464

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This reads an environment setting to enable or disable basic authentication.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The context maps a named environment variable to the documented authentication configuration. It does not show password disclosure or outbound use.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:122

JavaScript analysis reported javascript.xray.data-exfiltration

Expected behavior · medium confidence

The flagged line imports the operating-system module to apply a documented Android compatibility fix; it does not show data theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration in this repository.

Contextual assessment: The supplied source uses the operating-system module to inspect CPU availability and substitute a single synthetic CPU entry when Android or Termux reports none. This occurs in build tooling, not user-session code. No credential access, network destination, serialization, or exfiltration flow is present in the evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.data-exfiltration
File role
tooling
Source
vite.config.ts:3

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The launcher reads a local backend-path setting from an environment variable for configuration. The supplied evidence does not show that this value contains or exposes credentials.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.

Contextual assessment: The operation assigns an environment-controlled path to local configuration. No external destination, secret extraction, or disclosure behavior is evidenced.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.serialize-environment
File role
production
Source
launcher.js:125

Coverage and limitations

Inventory
422 files · 3464351 bytes
Contextual coverage
74 of 74 candidates assessed

JavaScript coverage

Status
Incomplete
Candidates
222 files · 1635391 bytes
Representations
222 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans
222 raw signatures · 17 raw AST · 222 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity
Full commit
a0d833c98dde05cea38bb372e5baa55529b82dde
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
api.openai.com · gpt-5.6-luna
Scanner
0.1.0
Scanner policy
4
Rule catalog
1
Contextual policy
2
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v5
Assessment schema
contextual-assessment-v1
Review usage
128746 input · 17444 output · 0 cache read · 0 reasoning tokens
Report
42ae888da12c47b6d478413b25f17b57d4d827f79016ba3fc25f074831925618