TavernKeeper Scan Report

Archkr/ST-BasicSpotify

Commit c6bb84e Reviewed

No material or high-risk concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 high 0 material 2 low

What this review found

No material or high-risk item was identified.

Expected scanner matches (2)

OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network

Expected behavior · high confidence

The extension sends the user's Spotify Client ID to Spotify's own official login server as part of a standard sign-in process. This is exactly how Spotify's authentication is supposed to work and does not expose any secrets to anyone other than Spotify.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.

Contextual assessment: The fetch call to the official Spotify token endpoint implements a standard OAuth2 PKCE authorization-code exchange. The client_id is a public OAuth2 identifier, not a secret, and is expected to be sent in the token request body per the Spotify Web API specification. The code_verifier is an ephemeral PKCE value retrieved from localStorage and used once for this exchange. The destination is Spotify's official accounts API, the data flow matches the stated optional Spotify API authentication feature, and no credentials are sent to any third-party or unexpected endpoint.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.credential-exfiltration.javascript-secret-to-network
File role
production
Source
index.js:142-154

Credential access and network transmission in one file

Expected behavior · high confidence

The extension reads the user's Spotify Client ID and sends it to Spotify's official servers to complete the login process. This is the normal, expected behavior for connecting to Spotify and does not send any credentials anywhere unexpected.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: This candidate flags the co-occurrence of credential access and network transmission in the same file. The credential in question is the OAuth2 client_id stored in extension settings, and the network sink is the official Spotify token endpoint. In a PKCE flow, the client_id is a public identifier intentionally transmitted to the authorization server's token endpoint. The code_verifier from localStorage is also sent to the same official endpoint as required by the PKCE specification. No credentials are transmitted to any non-Spotify destination, and the behavior is fully consistent with the documented optional Spotify API authentication feature.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 3
Rule
credential-exfiltration
File role
production
Source
index.js:142

Coverage and limitations

Tools

Limitations

Technical scan identity