No material or high-risk item was identified.
Expected scanner matches (10)
OpenGrep reported tavernkeeper.dynamic-execution.node-shell
Expected behavior · high confidence
The server runs a fixed git command to check for updates. Since it does not use any user-provided text in the command, it is safe from injection attacks.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.
Contextual assessment: The execSync call uses a hardcoded string ('git fetch origin') with no user-controlled input, preventing command injection. It is part of an authenticated self-update endpoint.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.node-shell
- File role
- production
- Source
- server.js:1620
OpenGrep reported tavernkeeper.dynamic-execution.node-shell
Expected behavior · high confidence
The server runs a fixed git command to see how many updates are available. Since it does not use any user-provided text in the command, it is safe from injection attacks.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.
Contextual assessment: The execSync call uses a hardcoded string ('git rev-list --count HEAD..origin/main') with no user-controlled input, preventing command injection. It is part of an authenticated self-update endpoint.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.node-shell
- File role
- production
- Source
- server.js:1623
OpenGrep reported tavernkeeper.dynamic-execution.node-shell
Expected behavior · high confidence
The server runs a fixed git command to download and apply updates. Since it does not use any user-provided text in the command, it is safe from injection attacks.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.
Contextual assessment: The execSync call uses a hardcoded string ('git pull origin main') with no user-controlled input, preventing command injection. It is part of an authenticated self-update endpoint that applies updates.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.node-shell
- File role
- production
- Source
- server.js:1638
Gitleaks reported curl-auth-header
Expected behavior · high confidence
This is just a sample command in the README telling users to put their own API key in the request. It is not a leaked secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule curl-auth-header in this repository.
Contextual assessment: The flagged text is a documentation example showing how to call the proxy API using curl. The Authorization header value is an obvious placeholder instructing the reader to substitute their own API key. No real credential is present in the supplied source context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- curl-auth-header
- File role
- documentation
- Source
- README.md:284-287
Credential access and network transmission in one file
Expected behavior · high confidence
This is a proxy server that supports CivitAI as one of its image generation backends. To use CivitAI, it needs to send your CivitAI API key to CivitAI's own servers, which is exactly what this code does. The key is only sent to the official CivitAI website and is used for its intended purpose.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The code reads a configured CivitAI API key and transmits it as a Bearer token to the official CivitAI consumer jobs endpoint. This is the stated purpose of the project: a multi-backend image generation proxy that supports CivitAI as one of its backends. The credential is sent only to the legitimate CivitAI API domain and is used solely for authenticating generation and job-polling requests. No exfiltration to unrelated or concealed destinations is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- server.js:878
Gitleaks reported curl-auth-header
Expected behavior · high confidence
This is just an example in the project instructions showing users how to format an API request. The API key shown is a placeholder, not a real secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule curl-auth-header in this repository.
Contextual assessment: The flagged text is a documentation example in a README showing how to call the image generation API using curl. The Authorization header value is an obvious placeholder instructing the reader to substitute their own API key. No real credential is present in the supplied source context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- curl-auth-header
- File role
- documentation
- Source
- README.md:322-325
OpenGrep reported tavernkeeper.dynamic-execution.node-shell
Expected behavior · high confidence
The server runs a fixed git command to check the remote version. Since it does not use any user-provided text in the command, it is safe from injection attacks.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.
Contextual assessment: The execSync call uses a hardcoded string ('git rev-parse origin/main') with no user-controlled input, preventing command injection. It is part of an authenticated self-update endpoint.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.node-shell
- File role
- production
- Source
- server.js:1622
OpenGrep reported tavernkeeper.dynamic-execution.node-shell
Expected behavior · high confidence
The server runs a fixed git command to get a list of recent changes. Since it does not use any user-provided text in the command, it is safe from injection attacks.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.
Contextual assessment: The execSync call uses a hardcoded string ('git log --oneline HEAD..origin/main') with no user-controlled input, preventing command injection. It is part of an authenticated self-update endpoint.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.node-shell
- File role
- production
- Source
- server.js:1629
OpenGrep reported tavernkeeper.dynamic-execution.node-shell
Expected behavior · high confidence
The server runs a fixed git command to check the current local version. Since it does not use any user-provided text in the command, it is safe from injection attacks.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.node-shell in this repository.
Contextual assessment: The execSync call uses a hardcoded string ('git rev-parse HEAD') with no user-controlled input, preventing command injection. It is part of an authenticated self-update endpoint.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.node-shell
- File role
- production
- Source
- server.js:1621
Credential access and network transmission in one file
Expected behavior · high confidence
This is a normal session and API key handling for a proxy application. The code creates a session ID for tracking and sends the user's API key to the local proxy server so it can authenticate with the chosen image generation backend. Nothing is sent to unexpected locations.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged line 1948 is session initialization: it reads a session ID from localStorage and, if absent, fetches one from the same-origin /api/session endpoint. The getHeaders() function (lines 1967-1974) sends the user-entered API key as a Bearer token to the same-origin proxy server, which is the stated purpose of this multi-backend image generation proxy. All network calls are to the local proxy server (same origin), which then forwards to configured backends. No evidence of credentials being sent to unexpected or third-party destinations.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- public/index.html:1948