No material or immediate-danger item was identified.
Expected scanner matches (14)
Dependency advisory GHSA-jr45-8vmc-qm54 applies
Expected behavior · medium confidence
This security warning points to a tool used only during development, not something included in the extension that users install. It does not affect people using the extension.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-jr45-8vmc-qm54 to a dependency declared by this repository.
Contextual assessment: The root package declares only devDependencies (eslint, fake-indexeddb, globals, jsdom) and no production dependencies. The visible transitive packages in the lockfile are marked dev:true. This advisory corresponds to a development-only dependency that is not shipped to end users of this browser extension, so the vulnerable code has no runtime reachability in production.
Impact: none · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-jr45-8vmc-qm54
- File role
- production
- Source
- package-lock.json
zizmor reported dangerous-triggers
Expected behavior · high confidence
This workflow waits for the project's CI to finish successfully on the main branch, then sends a notification to a related repository. The scanner flags the trigger type because it can sometimes be abused, but this workflow only runs when CI passes on the main branch from a push, which blocks the usual abuse path. No untrusted code is checked out or run here.
Technical evidence
Scanner reason: zizmor matched workflow-security rule dangerous-triggers in this repository.
Contextual assessment: The workflow_run trigger is flagged by zizmor because it executes in the default-branch context with secret access and can be indirectly triggered by workflows that run on pull requests. However, this workflow applies effective guards: it requires conclusion success, head_branch equal to main, and event equal to push. A fork-PR-triggered CI run would have a non-main head_branch and a pull_request event, so it cannot satisfy the job condition. The only secret used is a dispatch token passed to a pinned, well-known repository-dispatch action. The client payload is built from GitHub-controlled workflow_run metadata and the repository identifier, not from attacker-controlled file contents. No untrusted checkout or script execution occurs in this workflow.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- zizmor 1.28.0
- Rule
- dangerous-triggers
- File role
- tooling
- Source
- .github/workflows/notify-sillybunny.yml:3-8
Dependency advisory GHSA-8xcm-r25x-g524 applies
Expected behavior · medium confidence
This warning is about a development tool, not part of the extension users install. It does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.
Contextual assessment: The root package declares only devDependencies and no production dependencies. Visible transitive packages are marked dev:true. This advisory maps to a development-only dependency tree with no production runtime reachability for this browser extension.
Impact: none · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-8xcm-r25x-g524
- File role
- production
- Source
- package-lock.json
Gitleaks reported vault-service-token
Expected behavior · high confidence
The scanner thought it found a secret token, but the flagged line is just a settings slider for an image-generation feature with a default number value. There is no real password or key here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule vault-service-token in this repository.
Contextual assessment: The gitleaks vault-service-token rule matched a numeric default value inside an HTML template for an ADetailer confidence input control. The surrounding code is UI generation markup for image-generation settings (denoise, confidence, mask blur, etc.). There is no credential, token, secret, or sensitive data flow present; the match is a false positive on a decimal literal used as a form default.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- vault-service-token
- File role
- production
- Source
- index.js:17477
Dependency advisory GHSA-v3r7-h72x-cjcm applies
Expected behavior · medium confidence
This warning is about a development tool, not part of the extension users install. It does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.
Contextual assessment: The root package declares only devDependencies and no production dependencies. Visible transitive packages are marked dev:true. This advisory maps to a development-only dependency with no production runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v3r7-h72x-cjcm
- File role
- production
- Source
- package-lock.json
Gitleaks reported vault-service-token
Expected behavior · high confidence
The scanner thought it found a secret password or token, but the flagged line is just a setting for how an image generation tool should resize images. There is no secret here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule vault-service-token in this repository.
Contextual assessment: The flagged line is part of a ControlNet unit configuration object built for an A1111/Forge image generation API request. The surrounding code assigns generation settings such as resize_mode, control_mode, pixel_perfect, guidance_start, and guidance_end. The value on the flagged line is a user-facing resize mode string defaulting to a UI label. No credential, token, secret, or sensitive value is present in this data flow. The gitleaks vault-service-token rule produced a false positive on configuration text.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- vault-service-token
- File role
- production
- Source
- index.js:8510
Gitleaks reported vault-service-token
Expected behavior · high confidence
The scanner thought it found a secret, but the flagged line is just a dropdown menu label in the extension's settings screen. There is no password or key here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule vault-service-token in this repository.
Contextual assessment: The flagged line is part of an HTML template literal rendering a dropdown option for an IP-Adapter resize mode selector. The surrounding context shows UI option strings such as resize mode labels. No credential, token, secret, or sensitive value is present; the gitleaks vault-service-token rule produced a pattern coincidence on static UI text.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- vault-service-token
- File role
- production
- Source
- index.js:17567
Dependency advisory GHSA-4cwx-7wf7-3272 applies
Expected behavior · medium confidence
Even though this warning is rated high, it points to a development-only tool that is not included in the extension users install. It does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4cwx-7wf7-3272 to a dependency declared by this repository.
Contextual assessment: Although the scanner rates this advisory as high severity, the root package declares only devDependencies and no production dependencies. Visible transitive packages are marked dev:true. The vulnerable code is confined to the development toolchain and is not shipped to end users, so there is no production runtime reachability or user harm path.
Impact: none · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4cwx-7wf7-3272
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Expected behavior · medium confidence
Even though this warning is rated high, it points to a development-only tool that is not included in the extension users install. It does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: Although the scanner rates this advisory as high severity, the root package declares only devDependencies and no production dependencies. Visible transitive packages are marked dev:true. The vulnerable code is confined to the development toolchain and is not shipped to end users, eliminating production runtime reachability.
Impact: none · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- package-lock.json
zizmor reported artipacked
Expected behavior · high confidence
The automated test workflow does not save or upload any files that could contain credentials. It only runs tests and a dependency audit. The scanner warning does not apply to this workflow.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The zizmor artipacked rule flags potential credential persistence via Actions artifacts. This workflow contains no artifact upload or download steps. It checks out the repository, sets up Node.js, installs dependencies, runs a verify script, and runs npm audit. No secrets are referenced, no artifacts are persisted, and permissions are scoped to contents: read. The checkout action is pinned to a full SHA. There is no data flow that could persist credentials.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:27-28
Dependency advisory GHSA-m8rv-5g2x-5cg5 applies
Expected behavior · medium confidence
This warning is about a development tool, not part of the extension users install. It does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.
Contextual assessment: The root package declares only devDependencies and no production dependencies. Visible transitive packages are marked dev:true. This advisory maps to a development-only dependency with no production runtime reachability for this browser extension.
Impact: none · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-m8rv-5g2x-5cg5
- File role
- production
- Source
- package-lock.json
Gitleaks reported vault-service-token
Expected behavior · high confidence
This is another dropdown menu label in the settings screen, not a secret. The scanner matched ordinary text by accident.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule vault-service-token in this repository.
Contextual assessment: The flagged line is an adjacent option in the same IP-Adapter resize mode dropdown template. It contains only a static UI label and a conditional selected-state expression. No credential or sensitive material is present; the match is a false positive from the vault-service-token pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- vault-service-token
- File role
- production
- Source
- index.js:17568
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Expected behavior · medium confidence
Even though this warning is rated high, it points to a development-only tool that is not included in the extension users install. It does not affect end users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: Although the scanner rates this advisory as high severity, the root package declares only devDependencies and no production dependencies. Visible transitive packages are marked dev:true. The vulnerable code is confined to the development toolchain and is not shipped to end users, so there is no production runtime reachability or user harm path.
Impact: none · Exploitability: unlikely
Developer action: Update the affected dev dependency to a patched version when convenient; no user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- package-lock.json
Gitleaks reported vault-service-token
Expected behavior · high confidence
This is a dropdown menu label in the settings screen, not a secret. The scanner flagged normal text by mistake.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule vault-service-token in this repository.
Contextual assessment: The flagged line is the first option in the same resize mode dropdown template, containing a static UI label and a selected-state conditional. No token, credential, or secret value is present. The gitleaks rule matched coincidentally on ordinary UI text.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- vault-service-token
- File role
- production
- Source
- index.js:17566