TavernKeeper Scan Report

AventurasTeam/Aventuras

Commit 8ae0d79 Reviewed Aug 21, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 89 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (86)

Dependency advisory RUSTSEC-2025-0080:pkg:d9db6230dfa23e8ba0fa93cf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:108
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:95
Dependency advisory RUSTSEC-2024-0414:pkg:e12ed7daa8c1d8360f101be8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:42
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:113
Dependency advisory GHSA-72xf-g2v4-qvf3:pkg:2f098d09dffd8939e104e6f0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-2mjp-6q6p-2qxm:pkg:6d96a46fadb25a056091e448 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-m8rv-5g2x-5cg5:pkg:4960f6321d5eb83e948ad4ac applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:67
Dependency advisory GHSA-g8m3-5g58-fq7m:pkg:e4124745cfdd4bc7b9a15ac1 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory RUSTSEC-2026-0258:pkg:222a355a74aca3bba6fbb9da applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:92
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:102
Dependency advisory GHSA-v3r7-h72x-cjcm:pkg:3442b6d04e2f119213e16797 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-5v7r-6r5c-r473:pkg:db1c36cdfd066cb137608ca0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-vrm6-8vpv-qv8q:pkg:0b992fe91b0b56ff0c3a69a0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:43
Dependency advisory GHSA-vxpw-j846-p89q:pkg:2b5722d889310f1a977423f1 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory RUSTSEC-2024-0411:pkg:7048d8a9d3d0f0ec2dd07bfe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:42
Dependency advisory RUSTSEC-2023-0071:pkg:ee975215c8fb081d4be2c2de applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-pxg6-pf52-xh8x:pkg:6da1e3539f31ff57c2a349c3 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:46
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:97
Dependency advisory RUSTSEC-2024-0370:pkg:9b268f40461da81c7a1c55ed applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-w5hq-g745-h8pq:pkg:557a6d9a353e8755eba18deb applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:38-39
Dependency advisory RUSTSEC-2024-0413:pkg:c2f358c9f3bc98a14e0c2abf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:66
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: scripts/remote.test.js:10
Dependency advisory GHSA-wrw7-89jp-8q8g:pkg:4b30aae73f1836d87a5b008c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0258:pkg:95f9173f3d1ac6374e456fa8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:87
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:39
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:90
Dependency advisory RUSTSEC-2025-0081:pkg:5c764120c78ffcfe5027b39c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:146
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:18
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:116
Dependency advisory GHSA-2v37-7h3g-55p8:pkg:06ad0185911f4bb6106d61dc applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:91-92
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:48
Dependency advisory GHSA-fjxv-7rqg-78g4:pkg:6c89c9914b40635e432f1415 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:86-87
Dependency advisory GHSA-hmw2-7cc7-3qxx:pkg:b55f5aef11b0369cc46f988a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-6rw7-vpxm-498p:pkg:43bb4aeefd1a794ecdaf18ba applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:152
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:53
Dependency advisory RUSTSEC-2024-0429:pkg:d2e88fc02f6be9987f66e6e8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:19
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:90
Dependency advisory GHSA-35p6-xmwp-9g52:pkg:d8c1871761b9627fdd34c81b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:15-16
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: vite.config.js:5
Dependency advisory GHSA-8xcm-r25x-g524:pkg:cc5804616c4fb4e83e60068a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory RUSTSEC-2026-0235:pkg:d039eb756756d5d8fe092ddd applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:42-43
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:151
Dependency advisory RUSTSEC-2025-0100:pkg:bd8adf60c37242745cb633a0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2024-0418:pkg:b245323ca01b322dae07bf9b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2024-0420:pkg:d1377594ef97b5997d1bd6e4 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2024-0415:pkg:7feb02dbce543e0572f8f169 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0075:pkg:3e15a087e2f1d00bbc8d944a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0098:pkg:bc6e2fc910a7ca702c31e56a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:16
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:46
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: scripts/version.js:14
Dependency advisory RUSTSEC-2024-0416:pkg:c8c328b18837aef0f997eeec applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:95
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:13
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:12-35
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:52
Dependency advisory GHSA-p8p7-x288-28g6:pkg:e8e7ad0090121b0f387eaa27 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-p88m-4jfj-68fv:pkg:0aa6e836b145749eb5c5bae2 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-4992-7rv2-5pvq:pkg:787189633d8ba93446193680 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory RUSTSEC-2024-0419:pkg:694df782baf029578982f056 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2024-0412:pkg:4216c3e2f95d873b67813c23 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-v9p9-hfj2-hcw8:pkg:272b59ddefffdd1746f88817 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:53
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:107
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:157
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:111
Dependency advisory GHSA-g9mf-h72j-4rw9:pkg:2ae61459d96677abe6b160ba applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:102
Dependency advisory RUSTSEC-2024-0417:pkg:38b1a8e2b331be3a60dc921d applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock

Contextual expected matches (3)

zizmor reported superfluous-actions

Expected behavior · high confidence

A security scanner noted that a release workflow step might be redundant because the runner already includes similar functionality. This is a code cleanliness suggestion, not a security problem. The step safely uploads a built Android app to a GitHub release using the standard GitHub token.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: Zizmor flagged an informational audit note indicating that softprops/action-gh-release@v1 duplicates functionality already provided by the GitHub Actions runner. This is a workflow efficiency observation, not a security vulnerability. The step uses GITHUB_TOKEN from secrets to upload a pre-built APK to a GitHub release, which is the expected purpose of a release workflow. No untrusted input injection, credential exfiltration, or attacker-controlled data flow is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: zizmor 1.28.0
Rule: superfluous-actions
File role: tooling
Source: .github/workflows/ci.yml:157

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a public search key for a third-party character-listing website. The app tries to grab a fresh copy from that website's own public code first, and keeps a backup copy in case that fails. It is only used to search the website's public catalog. It is not a password or private key belonging to you or to this project.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The flagged value is a fallback search token for JannyAI's public Meilisearch endpoint. The code first attempts to dynamically extract a token from JannyAI's own client-side JavaScript (fetched from their public website), then falls back to this hardcoded value if that fetch fails. The token is sent only as a Bearer header to search.jannyai.com for read-only character search queries. It is not a user credential, not the project's own secret, and not used for authentication or authorization of private data. JannyAI exposes equivalent tokens in their public client-side code by design, as Meilisearch public search keys are intended for client-side use. No user data is exfiltrated and no user-owned credentials are involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: src/lib/services/discovery/providers/janny.ts:9

zizmor reported superfluous-actions

Expected behavior · high confidence

A security scanner noted that a release workflow step might be redundant. This is a maintenance suggestion, not a security issue. The step safely uploads a built Android app to a draft GitHub release.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: Zizmor flagged the same informational superfluous-actions note on softprops/action-gh-release@v1 in the stable release workflow. The step uploads a signed APK to a draft GitHub release using GITHUB_TOKEN from secrets. This is the intended behavior of a release pipeline. No injection, secret exposure, or attacker-controlled path is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: zizmor 1.28.0
Rule: superfluous-actions
File role: tooling
Source: .github/workflows/release.yml:152

Coverage and limitations

Inventory: 841 files · 9953497 bytes
Contextual coverage: 89 of 89 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 406 files · 2988987 bytes
X-Ray review families: 3 warning occurrences compacted to 3 evidence-preserving review families
Representations: 406 raw · 20 decoded · 0 normalized · 0 bundle modules
Stage scans: 406 raw signatures · 67 raw AST · 406 raw OpenGrep · 20 derived signatures · 0 derived AST · 20 derived OpenGrep

Unresolved JavaScript stages

scripts/release.js — derived-ast / parse
scripts/release.js — normalize / parse
src/lib/components/settings/advancedPanelView.test.ts — raw-ast / parse
src/lib/components/settings/advancedPanelView.ts — raw-ast / parse
src/lib/components/ui/alert/index.ts — raw-ast / parse
src/lib/components/ui/badge/index.ts — raw-ast / parse
src/lib/components/ui/button/index.ts — raw-ast / parse
src/lib/components/ui/drawer/index.ts — raw-ast / parse
src/lib/components/ui/responsive-modal/context.ts — raw-ast / parse
src/lib/components/ui/toggle/index.ts — raw-ast / parse
src/lib/components/vault/prompts/sampleContext.ts — raw-ast / parse
src/lib/components/vault/prompts/templateGroups.ts — raw-ast / parse
src/lib/components/wizard/wizardTypes.ts — raw-ast / parse
src/lib/constants/modelHealth.ts — raw-ast / parse
src/lib/log.ts — raw-ast / parse
src/lib/services/ai/BaseAIService.ts — raw-ast / parse
src/lib/services/ai/core/config.ts — raw-ast / parse
src/lib/services/ai/core/defaults.ts — raw-ast / parse
src/lib/services/ai/core/factory.ts — raw-ast / parse
src/lib/services/ai/core/reasoning.test.ts — raw-ast / parse
src/lib/services/ai/core/reasoning.ts — raw-ast / parse
src/lib/services/ai/core/types.ts — raw-ast / parse
src/lib/services/ai/generation/ActionChoicesService.ts — raw-ast / parse
src/lib/services/ai/generation/ClassifierService.ts — raw-ast / parse
src/lib/services/ai/generation/MemoryService.ts — raw-ast / parse
src/lib/services/ai/generation/NarrativeService.test.ts — raw-ast / parse
src/lib/services/ai/generation/NarrativeService.ts — raw-ast / parse
src/lib/services/ai/generation/StyleReviewerService.ts — raw-ast / parse
src/lib/services/ai/generation/SuggestionsService.ts — raw-ast / parse
src/lib/services/ai/generation/WorldStateInjector.test.ts — raw-ast / parse
src/lib/services/ai/generation/WorldStateInjector.ts — raw-ast / parse
src/lib/services/ai/generation/index.ts — raw-ast / parse
src/lib/services/ai/image/BackgroundImageService.ts — raw-ast / parse
src/lib/services/ai/image/ImageAnalysisService.ts — raw-ast / parse
src/lib/services/ai/image/InlineImageService.ts — raw-ast / parse
src/lib/services/ai/image/InlineImageTracker.test.ts — raw-ast / parse
src/lib/services/ai/image/InlineImageTracker.ts — raw-ast / parse
src/lib/services/ai/image/imageUtils.test.ts — raw-ast / parse
src/lib/services/ai/image/imageUtils.ts — raw-ast / parse
src/lib/services/ai/image/index.ts — raw-ast / parse
src/lib/services/ai/image/providers/a1111.ts — raw-ast / parse
src/lib/services/ai/image/providers/chutes.ts — raw-ast / parse
src/lib/services/ai/image/providers/comfy.ts — raw-ast / parse
src/lib/services/ai/image/providers/fetchAdapter.ts — raw-ast / parse
src/lib/services/ai/image/providers/google.ts — raw-ast / parse
src/lib/services/ai/image/providers/nanogpt.ts — raw-ast / parse
src/lib/services/ai/image/providers/openai.ts — raw-ast / parse
src/lib/services/ai/image/providers/openrouter.ts — raw-ast / parse
src/lib/services/ai/image/providers/pollinations.ts — raw-ast / parse
src/lib/services/ai/image/providers/registry.test.ts — raw-ast / parse
src/lib/services/ai/image/providers/registry.ts — raw-ast / parse
src/lib/services/ai/image/providers/types.ts — raw-ast / parse
src/lib/services/ai/image/providers/zhipu.ts — raw-ast / parse
src/lib/services/ai/image/stylePrompt.ts — raw-ast / parse
src/lib/services/ai/index.ts — raw-ast / parse
src/lib/services/ai/lorebook/LoreManagementService.ts — raw-ast / parse
src/lib/services/ai/lorebook/entryFields.ts — raw-ast / parse
src/lib/services/ai/lorebook/entryState.ts — raw-ast / parse
src/lib/services/ai/lorebook/index.ts — raw-ast / parse
src/lib/services/ai/lorebook/sessionChanges.test.ts — raw-ast / parse
src/lib/services/ai/lorebook/sessionChanges.ts — raw-ast / parse
src/lib/services/ai/retrieval/AgenticRetrievalService.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/AgenticRetrievalService.ts — raw-ast / parse
src/lib/services/ai/retrieval/EntryRetrievalService.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/EntryRetrievalService.ts — raw-ast / parse
src/lib/services/ai/retrieval/TimelineFillService.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/TimelineFillService.ts — raw-ast / parse
src/lib/services/ai/retrieval/alreadyInContext.ts — raw-ast / parse
src/lib/services/ai/retrieval/chapterContentBudget.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/chapterContentBudget.ts — raw-ast / parse
src/lib/services/ai/retrieval/grepSampling.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/grepSampling.ts — raw-ast / parse
src/lib/services/ai/retrieval/index.ts — raw-ast / parse
src/lib/services/ai/retrieval/recentTail.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/recentTail.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalHistory.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalHistory.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalSnapshot.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalSnapshot.ts — raw-ast / parse
src/lib/services/ai/retrieval/stickiness.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/stickiness.ts — raw-ast / parse
src/lib/services/ai/retrieval/tier2SecondPass.ts — raw-ast / parse
src/lib/services/ai/retrieval/tier3Selection.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/tier3Selection.ts — raw-ast / parse
src/lib/services/ai/retrieval/timelineFillGrouping.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/timelineFillGrouping.ts — raw-ast / parse
src/lib/services/ai/sdk/agents/factory.ts — raw-ast / parse
src/lib/services/ai/sdk/agents/index.ts — raw-ast / parse
src/lib/services/ai/sdk/agents/stopConditions.test.ts — raw-ast / parse
src/lib/services/ai/sdk/agents/stopConditions.ts — raw-ast / parse
src/lib/services/ai/sdk/generate.ts — raw-ast / parse
src/lib/services/ai/sdk/index.ts — raw-ast / parse
src/lib/services/ai/sdk/middleware/index.ts — raw-ast / parse
src/lib/services/ai/sdk/middleware/logging.ts — raw-ast / parse
src/lib/services/ai/sdk/middleware/patchResponse.ts — raw-ast / parse
src/lib/services/ai/sdk/middleware/promptSchema.test.ts — raw-ast / parse
src/lib/services/ai/sdk/middleware/promptSchema.ts — raw-ast / parse
src/lib/services/ai/sdk/middleware/retryMiddleware.ts — raw-ast / parse
src/lib/services/ai/sdk/middleware/uniqueToolCallId.ts — raw-ast / parse
src/lib/services/ai/sdk/presetResolution.test.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 8ae0d79a0df0745be3594fa5affcc98dd02c5a75
Completed: Aug 21, 2026
History depth: 10 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 0 fresh / 3 reused groups · 0 fresh / 3 reused candidates
Review source reports: aa180f97762996f9b5aa73b9c93d420c0c3c4036cc8ef01c8a7ea61a91a7e176
Evidence triage: 86 deterministic / 3 contextual candidates · 3 contextual / 17 total behavior cases
Model budget: 0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage: 0 input · 0 output · 0 cache read · 0 reasoning tokens
Report: 7876c0042bee7378b973521e2b98e28c768ca27b5159b94d14a40f35d78c628a