TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

AventurasTeam/Aventuras

Commit 25af214 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 135 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

zizmor reported secrets-inherit

Minor caution · high confidence

The iOS preview build gets every stored secret even though it doesn't need any signing secrets. Only maintainers can trigger it and the script is the project's own, so this is a tidiness issue, not an open door.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: The pre-release iOS build job is invoked as a reusable workflow with blanket secret inheritance. The workflow fires on pre-release tag pushes and manual dispatch, which require existing write access; the called workflow is a same-repository file that, as reviewed, uses no Apple signing secrets at all and only the repository token. Passing all repository secrets where the called workflow needs essentially none is a least-privilege hygiene weakness. No attacker-controlled trigger or secret-exfiltration data flow is demonstrated in the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Pass only the minimal secrets the iOS build workflow actually needs instead of inheriting all repository secrets.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/pre-release.yml:65

zizmor reported secrets-inherit

Minor caution · medium confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: low · Exploitability: unlikely

Developer action: Replace the blanket secrets passthrough with explicit forwarding of only the secrets each build workflow actually requires (for example the Android build's signing material), keeping the list minimal and documented.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/release.yml:57

zizmor reported secrets-inherit

Minor caution · high confidence

When a preview version is tagged, the build script gets all of the project's secrets rather than just the Android signing ones it uses. Only maintainers can trigger this, and the script is the project's own, so it is a tidy-up item rather than a real threat.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: The pre-release Android build job is invoked as a reusable workflow with blanket secret inheritance. The workflow triggers on version-tag pushes and manual dispatch, which requires existing write access to the repository, and the called workflow is a same-repository file. The over-sharing of all repository secrets versus the minimal set the build needs is a least-privilege hygiene weakness; no untrusted trigger, fork-PR path, or secret-exfiltration data flow is demonstrated in the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Pass only the Android signing secrets explicitly instead of inheriting all repository secrets.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/pre-release.yml:58

zizmor reported secrets-inherit

Minor caution · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: The Android build job is invoked as a reusable workflow with secrets passed wholesale via an inherit directive. The scanner flags this because it forwards every repository secret rather than only the ones the called workflow needs. In this specific configuration the exposure is bounded: the caller runs only on scheduled runs, pushes to the default branch, and manual dispatch — never on pull requests — and the called workflow lives in the same repository and is the same file reviewed here, whose secret usage is limited to the GitHub token and Android signing secrets for building and signing the project's own APK. No attacker-controlled trigger or exfiltration path is demonstrated, so this is a least-privilege hygiene weakness rather than a vulnerability.

Impact: low · Exploitability: unlikely

Developer action: Replace the blanket secret inheritance with explicit passing of only the secrets each called build workflow requires.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/ci.yml:59

zizmor reported unsound-ternary

Minor caution · high confidence

A conditional expression used to decide what text goes in a preview release's notes doesn't work the way its comment says — the notes always get the default preview text. That's a small cosmetic bug in release messaging, not a security problem.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unsound-ternary. The match applies to this repository.

Contextual assessment: The release-notes body field uses a chained and/or expression intended to leave the notes empty when reusing an existing draft. Because an empty string is falsy, the fallback text is selected in every case, so the intended conditional never produces the empty value. The effect is confined to release-notes text on the project's own draft releases; no secret, untrusted input, or shipped-app behavior is involved, and no attacker-controlled path exists.

Impact: low · Exploitability: unlikely

Developer action: Compute the body value in a prior step or use an explicit conditional so the empty-on-reuse case is actually achievable.

Scanner
zizmor 1.28.0
Rule
unsound-ternary
File role
tooling
Source
.github/workflows/pre-release.yml:46

zizmor reported secrets-inherit

Minor caution · high confidence

The build setup passes every stored secret to its own iOS build script when only one or two are needed. The scripts are trusted and run only from trusted triggers, so this is a best-practice cleanup rather than a real danger.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: The iOS build job is invoked as a reusable workflow with blanket secret inheritance. As with the other called jobs, the caller triggers only on scheduled runs, default-branch pushes, and manual dispatch, and the called workflow is a same-repository file whose only secret usage shown is the GitHub token. The inherit directive over-shares repository secrets relative to what the called workflow consumes, which is a least-privilege hygiene concern, but no attacker-controlled trigger, fork-PR path, or exfiltration data flow is present in the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Pass only the specific secrets the iOS build workflow needs instead of inheriting all of them.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/ci.yml:66

zizmor reported secrets-inherit

Minor caution · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: The desktop build job is invoked as a reusable workflow with blanket secret inheritance. The caller's permissions are restricted to repository content read access, the triggers exclude pull requests, and the called workflow is a same-repository file. The finding is that all repository secrets are forwarded rather than a minimal set; no attacker-controlled path or demonstrated exposure accompanies the supplied evidence, so it remains a least-privilege hygiene weakness.

Impact: low · Exploitability: unlikely

Developer action: Pass only the specific secrets the desktop build workflow needs instead of inheriting all of them.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/ci.yml:52

zizmor reported secrets-inherit

Minor caution · high confidence

The project's automated release process hands all of its private CI secrets to its own build sub-jobs, rather than passing only the specific ones needed. Since those sub-jobs are part of the same project and no evidence shows the secrets being sent anywhere else, this is a caution for maintainers, not a danger to users.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: The release workflow uses `secrets: inherit` when invoking three reusable build workflows, which unconditionally forwards every repository secret to the called jobs. The called workflows are first-party files in the same repository, triggered only by tag pushes or manual dispatch, and the evidence shows no third-party-controlled steps or attacker-controlled input reaching the inherited secrets. This is a CI hardening gap (unnecessary secret scope broadening) rather than a demonstrated exposure: the supplied evidence does not show any step in the called workflows that leaks, prints, or exfiltrates inherited secrets.

Impact: low · Exploitability: unlikely

Developer action: Pass only the specific secrets each build workflow needs (for example the release token) instead of `secrets: inherit`, so a future change to a build workflow cannot silently gain access to unrelated repository secrets.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/release.yml:64

zizmor reported secrets-inherit

Minor caution · medium confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: A second reusable-workflow call in the same job block uses the same blanket secrets passthrough. As with the sibling finding, the called workflow is local to the repository, invocation is limited to stable-tag pushes and manual dispatch by maintainers, and the supplied evidence identifies no untrusted trigger, external destination, or secret flow outside same-repository automation. The unconditional inheritance is a least-privilege weakness only.

Impact: low · Exploitability: unlikely

Developer action: Forward only the specific secrets this build workflow requires instead of inheriting all repository secrets.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/release.yml:49

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
tooling
Source
scripts/version.js:14

zizmor reported secrets-inherit

Minor caution · high confidence

The desktop preview build receives every stored secret instead of just the ones it uses. Only maintainers can start it and it runs the project's own code, so it's a best-practice cleanup rather than a danger.

Technical evidence

Scanner reason: zizmor matched workflow-security rule secrets-inherit. The match applies to this repository.

Contextual assessment: The pre-release desktop build job is invoked with blanket secret inheritance. Triggers are tag pushes and manual dispatch, both requiring repository write access, and the called workflow is same-repository. Forwarding every repository secret where only the token and signing secrets are needed is a least-privilege hygiene weakness; the supplied evidence shows no untrusted trigger or exfiltration path that would demonstrate exposure.

Impact: low · Exploitability: unlikely

Developer action: Pass only the specific secrets the desktop build workflow needs instead of inheriting all repository secrets.

Scanner
zizmor 1.28.0
Rule
secrets-inherit
File role
tooling
Source
.github/workflows/pre-release.yml:50

zizmor reported unsound-ternary

Minor caution · high confidence

The release workflow tries to say 'if this is a re-run, keep the notes I typed; otherwise use the default text.' Because of how the condition is written, the default text wins in both cases, so a maintainer's hand-written release notes could get replaced. It is a small bug in the release recipe, not a security issue.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unsound-ternary. The match applies to this repository.

Contextual assessment: The flagged expression uses a logical-operator construct that does not behave as a true ternary in the workflow expression language: when the intended 'empty' branch evaluates, its falsy value causes the fallback branch to be selected anyway. Per the adjacent in-file comment, the intent is to leave the release notes unset on re-runs so manually typed notes are preserved, so the construct defeats that intent and can overwrite a maintainer's draft notes. This is a correctness defect in maintainer-only release automation; no untrusted input, secret, or cross-boundary effect is involved.

Impact: low · Exploitability: unlikely

Developer action: Replace the pseudo-ternary with an explicit conditional (for example, setting the release-notes input only when the release state is not a draft re-run) so draft notes are genuinely preserved.

Scanner
zizmor 1.28.0
Rule
unsound-ternary
File role
tooling
Source
.github/workflows/release.yml:45
Deterministic technical evidence (117)

  • Dependency advisory RUSTSEC-2025-0080:pkg:d9db6230dfa23e8ba0fa93cf applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/pre-release.yml:24

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-desktop.yml:105

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:23

  • Dependency advisory GHSA-x8mw-p69m-v3mx:pkg:a0540cca953b4d48d93a63d5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/actions/build-version/action.yml:37

  • Dependency advisory GHSA-72xf-g2v4-qvf3:pkg:2f098d09dffd8939e104e6f0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-mcm9-63f2-9j32:pkg:4e13747c388bb440736ec354 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2mjp-6q6p-2qxm:pkg:6d96a46fadb25a056091e448 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-m8rv-5g2x-5cg5:pkg:4960f6321d5eb83e948ad4ac applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-desktop.yml:83

  • Dependency advisory GHSA-g8m3-5g58-fq7m:pkg:e4124745cfdd4bc7b9a15ac1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory RUSTSEC-2026-0258:pkg:222a355a74aca3bba6fbb9da applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:39

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:22-23

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:58

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/actions/npm-install/action.yml:34

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:50

  • Dependency advisory GHSA-v3r7-h72x-cjcm:pkg:3442b6d04e2f119213e16797 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-5v7r-6r5c-r473:pkg:db1c36cdfd066cb137608ca0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-vrm6-8vpv-qv8q:pkg:0b992fe91b0b56ff0c3a69a0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-j22f-vq7h-c4qm:pkg:10b8ede4b47dbb1f07fc9d89 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-vxpw-j846-p89q:pkg:2b5722d889310f1a977423f1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:10

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/lint-and-typecheck.yml:24

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/pre-release.yml:23-24

  • Dependency advisory RUSTSEC-2023-0071:pkg:ee975215c8fb081d4be2c2de applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory GHSA-pxg6-pf52-xh8x:pkg:6da1e3539f31ff57c2a349c3 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:112

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:24-25

  • Dependency advisory GHSA-9rgm-9g3h-6x36:pkg:8a05d6d431ec29dc9927e432 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory RUSTSEC-2024-0370:pkg:9b268f40461da81c7a1c55ed applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/pre-release.yml:39

  • Dependency advisory GHSA-w5hq-g745-h8pq:pkg:557a6d9a353e8755eba18deb applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/bootstrap-ios.yml:63

  • Dependency advisory GHSA-pmjh-fq2x-6v4x:pkg:814e6386268dbf3533461ca1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: scripts/remote.test.js:10

  • Dependency advisory GHSA-wrw7-89jp-8q8g:pkg:4b30aae73f1836d87a5b008c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory RUSTSEC-2026-0258:pkg:95f9173f3d1ac6374e456fa8 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:141

  • Dependency advisory GHSA-gxm5-99cw-xjw9:pkg:81e09ce5ae0e8767c53066f0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:33

  • Dependency advisory GHSA-q2hr-2g5m-vwhr:pkg:795fdc464a3888c7b68760ab applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rj75-hqrm-r3gf:pkg:a4af6219a55a2f6ca6f7c8d2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rx4f-c7p8-82vq:pkg:84b2df35347fd80a7d52507c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:152

  • Dependency advisory RUSTSEC-2025-0081:pkg:5c764120c78ffcfe5027b39c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-desktop.yml:76-80

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/bootstrap-ios.yml:22-23

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/bootstrap-ios.yml:23

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/actions/npm-install/action.yml:47

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/bootstrap-ios.yml:51

  • Dependency advisory GHSA-2gqq-gqf2-x968:pkg:46832ca569076237770558e9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2v37-7h3g-55p8:pkg:06ad0185911f4bb6106d61dc applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-vfj7-8cjw-p6xm:pkg:efd3ff768f6f1133cf11c41f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-fjxv-7rqg-78g4:pkg:6c89c9914b40635e432f1415 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-desktop.yml:77

  • Dependency advisory GHSA-hmw2-7cc7-3qxx:pkg:b55f5aef11b0369cc46f988a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-6rw7-vpxm-498p:pkg:43bb4aeefd1a794ecdaf18ba applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-hx4r-w6wj-j8fg:pkg:5bb8a5f56915b9cd542611e7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-8436-99hf-9mmv:pkg:8ca5f098d431dc526b1c0927 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: src/lib/services/syncActions.test.ts:15

  • Dependency advisory RUSTSEC-2024-0429:pkg:d2e88fc02f6be9987f66e6e8 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • zizmor reported cache-poisoning · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:50

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:32-33

  • Dependency advisory GHSA-rfgv-xxqx-mfg5:pkg:fa194ca81f9401706246a35f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:54

  • Dependency advisory GHSA-r53p-7pc4-xj5r:pkg:bd7641efc84f0d9546a70936 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-35p6-xmwp-9g52:pkg:d8c1871761b9627fdd34c81b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-desktop.yml:114

  • JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

    Source: vite.config.js:5

  • Dependency advisory GHSA-6j4f-fj2g-mc7p:pkg:1b256821002216bb3b207a3c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

    Source: scripts/fake-provider.mjs:243

  • Dependency advisory GHSA-4q55-j62x-fr9h:pkg:9f69c30a03e3f5f9a019f9ac applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-8xcm-r25x-g524:pkg:cc5804616c4fb4e83e60068a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory RUSTSEC-2026-0235:pkg:d039eb756756d5d8fe092ddd applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory GHSA-68fv-2mgg-jv7q:pkg:9534329f616dc744f00f37e0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-r9w8-h9r3-54w4:pkg:ac70b50d579964b7d1bf096b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2jfj-6hjv-fm6j:pkg:175831eb9d2400b3cdc340b4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:25

  • Dependency advisory GHSA-2mjx-qc3c-rqvc:pkg:ee12e3e5ce328c0b556ddaed applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory GHSA-w293-vg96-wgc3:pkg:d43b5e923dc7ff1e776c4a60 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory RUSTSEC-2025-0100:pkg:bd8adf60c37242745cb633a0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory GHSA-r53p-7pc4-xj5r:pkg:1059646a53ed0e896cbf29be applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/actions/npm-install/action.yml:20

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/pre-release.yml:10

  • Dependency advisory RUSTSEC-2026-0285:pkg:08db2c0c1ca8ee1872b3d40f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory RUSTSEC-2025-0075:pkg:3e15a087e2f1d00bbc8d944a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory RUSTSEC-2025-0098:pkg:bc6e2fc910a7ca702c31e56a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • Dependency advisory GHSA-3wwx-pv8p-q78v:pkg:a08e866514b3f530ce58da45 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-82fw-gwwq-j7x9:pkg:e73b265e463302d69e55909b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory RUSTSEC-2026-0293:pkg:8490244dc01980c032c6e3d6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: src-tauri/Cargo.lock

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:112

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/lint-and-typecheck.yml:23-24

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:69

  • Dependency advisory GHSA-qhr7-859c-m2p7:pkg:30aebd0885cdb30a5bdc22ef applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:47

  • Dependency advisory GHSA-p8p7-x288-28g6:pkg:e8e7ad0090121b0f387eaa27 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-p88m-4jfj-68fv:pkg:0aa6e836b145749eb5c5bae2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-4992-7rv2-5pvq:pkg:787189633d8ba93446193680 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-x5rw-q4pp-hg5g:pkg:2b78b08a9e392fafe5d66576 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-desktop.yml:132

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:38

  • Dependency advisory GHSA-3xpg-4rpp-hhhm:pkg:a6f8bf7a6965562dac1ca61a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:74

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/bootstrap-ios.yml:29

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:100

  • Dependency advisory GHSA-v9p9-hfj2-hcw8:pkg:272b59ddefffdd1746f88817 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:99

  • Dependency advisory GHSA-4mjr-xmp4-gh2g:pkg:71d1998e85e0b475b0071821 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-wf3x-273g-mvxv:pkg:4e96fe7cea42e42227d0bdb1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-82fw-gwwq-j7x9:pkg:00f885f51d12cc13a66b964f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported cache-poisoning · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-android.yml:69

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:92

  • JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: scripts/package-manager.test.js:3

  • Dependency advisory GHSA-g9mf-h72j-4rw9:pkg:2ae61459d96677abe6b160ba applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported cache-poisoning · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/build-ios.yml:54

Contextual expected matches (6)

Credential access and network transmission in one file

Expected behavior · high confidence

This is a developer test that optionally checks that the app's public character-catalog searches still work. It reads no passwords or API keys and sends nothing private anywhere — it only downloads the same public content users would get. The scanner flagged it because a fetch call appears in the file, but there is no secret for it to leak.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The scanner flagged a credential-source-plus-network-sink correlation in a test file. The supplied source contains no credential access at all: the file is an opt-in live smoke test (skipped unless an environment flag is set) that mocks the production HTTP wrapper with the standard fetch API, searches public character catalogs, and validates the downloaded card parses correctly. The only network destinations are the public discovery providers being tested, and no user credentials, environment secrets, or private data are read or transmitted. The heuristic correlation does not correspond to any credential data flow in this file.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 5
Rule
credential-exfiltration
File role
test
Source
src/lib/services/discovery/providers/providers.live.test.ts:12

zizmor reported superfluous-actions

Expected behavior · high confidence

The iOS build automation publishes the app package it just built to the project's own release page. An audit note suggests a redundant helper tool is being used, but nothing sensitive is sent anywhere and the app users install is unaffected.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The flagged step is a release-upload step in the iOS build workflow that attaches the project's own unsigned IPA artifact to a draft release when publishing. The scanner's informational finding is that the third-party release action duplicates capability already present in the runner environment. The workflow uses no signing secrets, and the step's only data flow is uploading a locally built artifact to the repository's own release. No untrusted input path or secret exposure is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
superfluous-actions
File role
tooling
Source
.github/workflows/build-ios.yml:112

zizmor reported superfluous-actions

Expected behavior · high confidence

A style checker thinks the release tooling is unnecessary because the runner can do something similar. This is a housekeeping suggestion about the build recipe, not a security problem.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The scanner's informational rule flags a third-party release-publishing action as redundant with built-in runner functionality. The step uses a widely used, pinned-by-major-version release action to create a draft release on the project's own repository, which matches the stated release purpose. The flagged item is a tooling-style lint, not a data flow, exposure, or attacker-controlled path, and no security consequence is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
superfluous-actions
File role
tooling
Source
.github/workflows/release.yml:38

zizmor reported superfluous-actions

Expected behavior · high confidence

The automated build script uses a helper tool to publish the finished Android app package to the project's own release page. An audit tool notes a slightly different way of doing this, but nothing here sends data anywhere unexpected or affects the app users download.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The scanner flags a release-upload step in the Android build workflow as using a third-party action whose functionality is already provided by the GitHub runner environment. The step only attaches a built, signed APK artifact to a draft release when a publish input is true, gated behind a same-repo guard action. This is a workflow-hygiene informational finding with no data flow beyond uploading the project's own build output to its own GitHub release. No untrusted input, secret exposure, or shipped-app behavior is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
superfluous-actions
File role
tooling
Source
.github/workflows/build-android.yml:152

Gitleaks reported generic-api-key

Expected behavior · high confidence

The flagged "secret" is a publicly available search key that the JannyAI website itself hands out to every visitor's browser. The app keeps a copy as a backup in case fetching the fresh one fails. It is not anyone's private key, cannot access user accounts or user data, and is only used to search a public character catalog — a feature the app openly advertises.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The scanner matched a 64-hex-character constant as a generic API key. The full source shows this is a fallback bearer token for JannyAI's public character-search endpoint. The same file dynamically fetches the identical token from JannyAI's public client-side configuration JavaScript served to every website visitor, meaning the token is published by the service itself for public search access. It grants only search-query capability, is not a user credential, not a provider API key, and is never combined with any user-entered secret. No user credentials, private content, or privileged tokens are involved; the only data flows are search queries and character-card downloads to JannyAI's own documented endpoints, which matches the project's stated character discovery feature. The download URL is additionally validated against a fixed allow-list of hosts.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
src/lib/services/discovery/providers/janny.ts:28

zizmor reported superfluous-actions

Expected behavior · high confidence

A helper tool is used to create the draft release entry for preview builds. An audit note says the runner could do this natively, but nothing here exposes data or affects users.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The flagged step uses a third-party release action to create or reuse a draft pre-release in the project's own repository, driven entirely by repository-maintainer-controlled inputs (tag name, version, commit SHA). The scanner's informational note is that the runner already provides equivalent functionality. The step touches no secrets beyond the workflow token and no untrusted content.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
superfluous-actions
File role
tooling
Source
.github/workflows/pre-release.yml:39

Coverage and limitations

Inventory
1005 files · 11236129 bytes
Contextual coverage
135 of 135 candidates assessed

JavaScript coverage

Status
Incomplete
Candidates
543 files · 3864372 bytes
X-Ray review families
8 warning occurrences compacted to 6 evidence-preserving review families
Representations
543 raw · 23 decoded · 0 normalized · 0 bundle modules
Stage scans
543 raw signatures · 78 raw AST · 543 raw OpenGrep · 23 derived signatures · 0 derived AST · 23 derived OpenGrep

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity
Full commit
25af2145b2b58675c7bb82c7e096017f750562d0
Completed
History depth
8 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
9 fresh / 0 reused groups · 17 fresh / 0 reused candidates
Review source reports
none
Evidence triage
118 deterministic / 17 contextual candidates · 9 contextual / 31 total behavior cases
Model budget
3 model calls · 9 / 12 fresh cases · 95689 / 200000 estimated input · 72466 / 250000 actual input · 8159 / 40000 output tokens
Review batching
3 model calls · up to 5 groups and 10 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
72466 input · 8159 output · 2719 cache read · 1912 reasoning tokens
Report
07d86b8dab5f25ca49c4f79c132e324413bd053290d6bee0e3c0b92fa2056c0d