TavernKeeper Scan Report

AventurasTeam/Aventuras

Commit cd643f4 Reviewed Sep 16, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 85 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

Gitleaks reported generic-api-key

Minor caution · high confidence

The flagged 'secret' is a publicly distributed access token for a character-sharing website, the same one the site itself shows to every visitor. The app tries to fetch the current token from that site and only falls back to this copy if fetching fails. It is not a private password or user key, and nothing sensitive is sent anywhere.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The scanner matched a 64-hex-character constant used as a fallback bearer token for a character-card discovery provider. The surrounding code shows this token is a public, client-side search credential: the provider first fetches the token at runtime from the target site's own public client-config script, and the constant is only a fallback when that fetch fails. The same value format is present in the site's public JavaScript, so it is a shared public token, not a project owner's private key or a user credential. All requests using it go to the discovery service's own search endpoint, the download path is restricted to a fixed allowlist of hosts with HTTPS and no port, and no user credentials, API keys, or private content are transmitted. Hardcoding a third-party site's token creates a maintenance fragility and a pattern scanners flag, but no concrete exposure of a private secret is demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Add a comment marking the constant as a public client token to reduce future scanner noise, and prefer the runtime-fetched token path; no secret rotation is required.

Scanner: gitleaks 8.30.1
Rule: generic-api-key
File role: production
Source: src/lib/services/discovery/providers/janny.ts:28

zizmor reported superfluous-actions

Minor caution · high confidence

Another housekeeping note about the release build using a helper step the build machine already covers. The workflow signs and publishes the app normally, keeps secrets in environment variables, and only runs when maintainers push a release tag. Nothing harmful is shown.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The finding again flags workflow steps that duplicate runner-provided functionality. This stable-release workflow builds desktop and Android artifacts, signs the APK with repository secrets bound through environment variables, and publishes release assets using the job token. The release step also enables a draft release and updater JSON, which is consistent with the project's stated distribution flow. Secrets are referenced via the environment block rather than inline expansion into shell commands, and triggers are tag pushes and manual dispatch, so no fork- or pull-request-controlled input reaches script execution. The flagged redundancy only marginally widens the CI third-party action surface; no exfiltration, secret disclosure, or attacker-controlled path is demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Optionally drop the redundant action to reduce third-party CI dependencies; no security fix is needed.

Scanner: zizmor 1.28.0
Rule: superfluous-actions
File role: tooling
Source: .github/workflows/release.yml:154

zizmor reported superfluous-actions

Minor caution · high confidence

This is a code-quality note about the build pipeline using a helper step that the build machine could already do by itself. The pipeline itself looks normal: it builds the app, signs it with the project's own signing secrets, and publishes the results. No data leaks or attacker-controlled behavior is shown.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The workflow-audit finding flags a step that duplicates functionality already preinstalled on the GitHub-hosted runner. The supplied workflow is a standard tag-triggered release pipeline: it checks out the repository, installs toolchains, builds a Tauri desktop and Android app, signs the APK with repository secrets via environment variables, and uploads artifacts and release assets with the job's contents-write token. Secret values are passed through environment mappings rather than interpolated into command lines, and no untrusted input (such as pull-request titles or issue bodies) is passed to script execution. The flagged redundancy adds a small unnecessary third-party action to the CI supply chain but introduces no credential disclosure, untrusted-input path, or malicious data flow.

Impact: low · Exploitability: unlikely

Developer action: Optionally remove the redundant action step to shrink the CI supply-chain surface; no security change is required.

Scanner: zizmor 1.28.0
Rule: superfluous-actions
File role: tooling
Source: .github/workflows/ci.yml:172

Deterministic technical evidence (81)

Dependency advisory RUSTSEC-2025-0080:pkg:d9db6230dfa23e8ba0fa93cf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:95
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:107
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:42
Dependency advisory GHSA-72xf-g2v4-qvf3:pkg:2f098d09dffd8939e104e6f0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-2mjp-6q6p-2qxm:pkg:6d96a46fadb25a056091e448 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-m8rv-5g2x-5cg5:pkg:4960f6321d5eb83e948ad4ac applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:67
Dependency advisory GHSA-g8m3-5g58-fq7m:pkg:e4124745cfdd4bc7b9a15ac1 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory RUSTSEC-2026-0258:pkg:222a355a74aca3bba6fbb9da applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:115
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:92
Dependency advisory GHSA-v3r7-h72x-cjcm:pkg:3442b6d04e2f119213e16797 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-5v7r-6r5c-r473:pkg:db1c36cdfd066cb137608ca0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-vrm6-8vpv-qv8q:pkg:0b992fe91b0b56ff0c3a69a0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:96
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:43
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:166
Dependency advisory GHSA-vxpw-j846-p89q:pkg:2b5722d889310f1a977423f1 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:42
Dependency advisory RUSTSEC-2023-0071:pkg:ee975215c8fb081d4be2c2de applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-pxg6-pf52-xh8x:pkg:6da1e3539f31ff57c2a349c3 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:46
Dependency advisory RUSTSEC-2024-0370:pkg:9b268f40461da81c7a1c55ed applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-w5hq-g745-h8pq:pkg:557a6d9a353e8755eba18deb applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:38-39
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:66
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: scripts/remote.test.js:10
Dependency advisory GHSA-wrw7-89jp-8q8g:pkg:4b30aae73f1836d87a5b008c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0258:pkg:95f9173f3d1ac6374e456fa8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:101
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:87
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:39
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:90
Dependency advisory RUSTSEC-2025-0081:pkg:5c764120c78ffcfe5027b39c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:18
Dependency advisory GHSA-2v37-7h3g-55p8:pkg:06ad0185911f4bb6106d61dc applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:91-92
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:48
Dependency advisory GHSA-fjxv-7rqg-78g4:pkg:6c89c9914b40635e432f1415 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:86-87
Dependency advisory GHSA-hmw2-7cc7-3qxx:pkg:b55f5aef11b0369cc46f988a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-6rw7-vpxm-498p:pkg:43bb4aeefd1a794ecdaf18ba applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported cache-poisoning · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:53
Dependency advisory RUSTSEC-2024-0429:pkg:d2e88fc02f6be9987f66e6e8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:19
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:90
Dependency advisory GHSA-35p6-xmwp-9g52:pkg:d8c1871761b9627fdd34c81b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:15-16
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:140
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:154
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: vite.config.js:5
Dependency advisory GHSA-8xcm-r25x-g524:pkg:cc5804616c4fb4e83e60068a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory RUSTSEC-2026-0235:pkg:d039eb756756d5d8fe092ddd applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:42-43
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:101
Dependency advisory RUSTSEC-2025-0100:pkg:bd8adf60c37242745cb633a0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0285:pkg:08db2c0c1ca8ee1872b3d40f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0075:pkg:3e15a087e2f1d00bbc8d944a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0098:pkg:bc6e2fc910a7ca702c31e56a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:16
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:46
Dependency advisory GHSA-82fw-gwwq-j7x9:pkg:e73b265e463302d69e55909b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:110
JavaScript analysis reported javascript.xray.unsafe-regex · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-unsafe-regex-inert · Execution scope: tooling-only

Source: scripts/version.js:14
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:95
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:13
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/lint-and-typecheck.yml:12-35
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:52
Dependency advisory GHSA-p8p7-x288-28g6:pkg:e8e7ad0090121b0f387eaa27 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-p88m-4jfj-68fv:pkg:0aa6e836b145749eb5c5bae2 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-4992-7rv2-5pvq:pkg:787189633d8ba93446193680 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/release.yml:148
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:106
Dependency advisory GHSA-v9p9-hfj2-hcw8:pkg:272b59ddefffdd1746f88817 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:53
Dependency advisory GHSA-4mjr-xmp4-gh2g:pkg:71d1998e85e0b475b0071821 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:172
Dependency advisory GHSA-82fw-gwwq-j7x9:pkg:00f885f51d12cc13a66b964f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-g9mf-h72j-4rw9:pkg:2ae61459d96677abe6b160ba applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:112

Contextual expected matches (1)

Credential access and network transmission in one file

Expected behavior · high confidence

Detailed wording was omitted by the public report safety filter.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The scanner flagged a credential source and an outbound network sink co-occurring in this test file. The supplied source shows no credential access at all: the only environment variable read is a boolean-style feature flag that gates the tests, and the only network-related code is a mock that substitutes the production Tauri HTTP wrapper with the platform fetch so live smoke tests can run in Node. When explicitly enabled, the tests search and download public character cards from the project's discovery providers and validate the payload with the production parser. No secrets, user credentials, or private content are read or transmitted, and the tests are skipped by default. The file-role correlation is a false positive on data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: test
Source: src/lib/services/discovery/providers/providers.live.test.ts:12

Coverage and limitations

Inventory: 910 files · 10473003 bytes
Contextual coverage: 85 of 85 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 475 files · 3424714 bytes
X-Ray review families: 3 warning occurrences compacted to 3 evidence-preserving review families
Representations: 475 raw · 22 decoded · 0 normalized · 0 bundle modules
Stage scans: 475 raw signatures · 70 raw AST · 475 raw OpenGrep · 22 derived signatures · 0 derived AST · 22 derived OpenGrep

Unresolved JavaScript stages

scripts/release.js — derived-ast / parse
scripts/release.js — normalize / parse
src/lib/components/settings/advancedPanelView.test.ts — raw-ast / parse
src/lib/components/settings/advancedPanelView.ts — raw-ast / parse
src/lib/components/ui/alert/index.ts — raw-ast / parse
src/lib/components/ui/badge/index.ts — raw-ast / parse
src/lib/components/ui/button/index.ts — raw-ast / parse
src/lib/components/ui/drawer/index.ts — raw-ast / parse
src/lib/components/ui/responsive-modal/context.ts — raw-ast / parse
src/lib/components/ui/toggle/index.ts — raw-ast / parse
src/lib/components/vault/prompts/sampleContext.ts — raw-ast / parse
src/lib/components/vault/prompts/templateGroups.test.ts — raw-ast / parse
src/lib/components/vault/prompts/templateGroups.ts — raw-ast / parse
src/lib/components/wizard/wizardTypes.ts — raw-ast / parse
src/lib/constants/modelHealth.ts — raw-ast / parse
src/lib/log.ts — raw-ast / parse
src/lib/services/activity/duration.test.ts — raw-ast / parse
src/lib/services/activity/duration.ts — raw-ast / parse
src/lib/services/activity/index.ts — raw-ast / parse
src/lib/services/activity/recorder.test.ts — raw-ast / parse
src/lib/services/activity/recorder.ts — raw-ast / parse
src/lib/services/activity/reporter.ts — raw-ast / parse
src/lib/services/activity/retention.test.ts — raw-ast / parse
src/lib/services/activity/retention.ts — raw-ast / parse
src/lib/services/activity/trackPhase.test.ts — raw-ast / parse
src/lib/services/activity/trackPhase.ts — raw-ast / parse
src/lib/services/activity/tree.test.ts — raw-ast / parse
src/lib/services/activity/tree.ts — raw-ast / parse
src/lib/services/activity/types.ts — raw-ast / parse
src/lib/services/ai/BaseAIService.ts — raw-ast / parse
src/lib/services/ai/core/config.ts — raw-ast / parse
src/lib/services/ai/core/defaults.ts — raw-ast / parse
src/lib/services/ai/core/factory.ts — raw-ast / parse
src/lib/services/ai/core/reasoning.test.ts — raw-ast / parse
src/lib/services/ai/core/reasoning.ts — raw-ast / parse
src/lib/services/ai/core/types.ts — raw-ast / parse
src/lib/services/ai/generation/ActionChoicesService.ts — raw-ast / parse
src/lib/services/ai/generation/ClassifierService.ts — raw-ast / parse
src/lib/services/ai/generation/MemoryService.ts — raw-ast / parse
src/lib/services/ai/generation/NarrativeService.test.ts — raw-ast / parse
src/lib/services/ai/generation/NarrativeService.ts — raw-ast / parse
src/lib/services/ai/generation/StyleReviewerService.ts — raw-ast / parse
src/lib/services/ai/generation/SuggestionsService.ts — raw-ast / parse
src/lib/services/ai/generation/WorldStateInjector.test.ts — raw-ast / parse
src/lib/services/ai/generation/WorldStateInjector.ts — raw-ast / parse
src/lib/services/ai/generation/index.ts — raw-ast / parse
src/lib/services/ai/image/BackgroundImageService.ts — raw-ast / parse
src/lib/services/ai/image/ImageAnalysisService.ts — raw-ast / parse
src/lib/services/ai/image/InlineImageService.ts — raw-ast / parse
src/lib/services/ai/image/InlineImageTracker.test.ts — raw-ast / parse
src/lib/services/ai/image/InlineImageTracker.ts — raw-ast / parse
src/lib/services/ai/image/imageUtils.test.ts — raw-ast / parse
src/lib/services/ai/image/imageUtils.ts — raw-ast / parse
src/lib/services/ai/image/index.ts — raw-ast / parse
src/lib/services/ai/image/providers/a1111.ts — raw-ast / parse
src/lib/services/ai/image/providers/chutes.ts — raw-ast / parse
src/lib/services/ai/image/providers/comfy.ts — raw-ast / parse
src/lib/services/ai/image/providers/fetchAdapter.ts — raw-ast / parse
src/lib/services/ai/image/providers/google.ts — raw-ast / parse
src/lib/services/ai/image/providers/nanogpt.ts — raw-ast / parse
src/lib/services/ai/image/providers/openai.ts — raw-ast / parse
src/lib/services/ai/image/providers/openrouter.ts — raw-ast / parse
src/lib/services/ai/image/providers/pollinations.ts — raw-ast / parse
src/lib/services/ai/image/providers/registry.test.ts — raw-ast / parse
src/lib/services/ai/image/providers/registry.ts — raw-ast / parse
src/lib/services/ai/image/providers/types.ts — raw-ast / parse
src/lib/services/ai/image/providers/zhipu.ts — raw-ast / parse
src/lib/services/ai/image/stylePrompt.ts — raw-ast / parse
src/lib/services/ai/index.ts — raw-ast / parse
src/lib/services/ai/lorebook/LoreManagementService.ts — raw-ast / parse
src/lib/services/ai/lorebook/entryFields.ts — raw-ast / parse
src/lib/services/ai/lorebook/entryState.ts — raw-ast / parse
src/lib/services/ai/lorebook/index.ts — raw-ast / parse
src/lib/services/ai/lorebook/sessionChanges.test.ts — raw-ast / parse
src/lib/services/ai/lorebook/sessionChanges.ts — raw-ast / parse
src/lib/services/ai/retrieval/AgenticRetrievalService.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/AgenticRetrievalService.ts — raw-ast / parse
src/lib/services/ai/retrieval/EntryRetrievalService.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/EntryRetrievalService.ts — raw-ast / parse
src/lib/services/ai/retrieval/TimelineFillService.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/TimelineFillService.ts — raw-ast / parse
src/lib/services/ai/retrieval/alreadyInContext.ts — raw-ast / parse
src/lib/services/ai/retrieval/chapterContentBudget.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/chapterContentBudget.ts — raw-ast / parse
src/lib/services/ai/retrieval/grepSampling.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/grepSampling.ts — raw-ast / parse
src/lib/services/ai/retrieval/index.ts — raw-ast / parse
src/lib/services/ai/retrieval/recentTail.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/recentTail.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalHistory.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalHistory.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalSnapshot.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalSnapshot.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalSteps.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/retrievalSteps.ts — raw-ast / parse
src/lib/services/ai/retrieval/stickiness.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/stickiness.ts — raw-ast / parse
src/lib/services/ai/retrieval/tier2SecondPass.ts — raw-ast / parse
src/lib/services/ai/retrieval/tier3Selection.test.ts — raw-ast / parse
src/lib/services/ai/retrieval/tier3Selection.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: cd643f417eab56748f34a7c27fe423832d55a999
Completed: Sep 16, 2026
History depth: 7 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 4 fresh / 0 reused groups · 4 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 81 deterministic / 4 contextual candidates · 4 contextual / 17 total behavior cases
Model budget: 1 model call · 4 / 12 fresh cases · 44405 / 200000 estimated input · 43902 / 250000 actual input · 2619 / 40000 output tokens
Review batching: 1 model call · up to 4 groups and 4 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 43902 input · 2619 output · 0 cache read · 1033 reasoning tokens
Report: c84fe369044841553ba87dd8c80a9bbeaa277c090fc14fcb25a67b3feb2a514f