TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

lunarblazepony/BlazeTracker

Commit 00d8d49 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 108 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (92)

  • Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:ed41a2fd10becce80f384db1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-qx2v-qp2m-jg93:pkg:d0433ccd51b55fc561da06bf applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-5xrq-8626-4rwp:pkg:d3693c5162b4693233bd7c05 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:95-193

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:29-46

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:67-93

  • Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:28854f305be882a9e2e7df02 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-58qx-3vcg-4xpx:pkg:464f1e56f88977dff15c5c23 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:115

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:125

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:126

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:134

  • Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:43e07f35874a75332fae5db1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:105

  • Dependency advisory GHSA-23c5-xmqv-rm74:pkg:732c7481baa8e54386dfde00 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-4c8g-83qw-93j6:pkg:1372faecb5851c2db1a935f0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:56

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:195-229

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:a6af0e9fdfc814bb2702c837 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-23c5-xmqv-rm74:pkg:28c6f8e6010383b649a97a01 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3v7f-55p6-f55p:pkg:6567e5dee65459862e18aa65 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-h67p-54hq-rp68:pkg:0199d54d4e55594b20539f39 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:06e609558382e589a31815a6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/docs.yml:12

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:79

  • Dependency advisory GHSA-5p4m-2wfm-xmqj:pkg:a2732cf17ea59b7c9ad7dcba applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-q3j6-qgpj-74h6:pkg:72c95ab6d027fa66d4c2567c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-p9ff-h696-f583:pkg:069647fe77c1487b564f3366 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-mw96-cpmx-2vgc:pkg:a9ed63d0a978334d53905df8 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-7r86-cg39-jmmj:pkg:1a39cca405ef708861dee501 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-25h7-pfq9-p65f:pkg:b1d04aa3fb09699f2ce52d11 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:101

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:a3638530d49c16954a754a83 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:f943bf04aa1d0078992a0950 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3ppc-4f35-3m26:pkg:173c1b2fab8e025126fb982c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-r28c-9q8g-f849:pkg:309438d8c981844c76003c01 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:37

  • Dependency advisory GHSA-p9ff-h696-f583:pkg:fe2ab2404670af8c9c875487 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-f886-m6hf-6m8v:pkg:16af9086b5e4ae9e3d4dc665 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-4x5r-pxfx-6jf8:pkg:c35e63c99af6b062ca71058b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:48-65

  • Dependency advisory GHSA-v39h-62p7-jpjc:pkg:33e1140242e3fdb4577a5fde applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:201

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/docs.yml:61

  • Dependency advisory GHSA-7r86-cg39-jmmj:pkg:fa706fb036ae029fca4e7e55 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:56fd66430fa2724b4206a4ad applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-rf6f-7fwh-wjgh:pkg:b63e05e77a564d495c499726 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-qj8w-gfj5-8c6v:pkg:7d87d343aa0c80bd7734851a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-6g55-p6wh-862q:pkg:be20184562ed7ac60b9bb3c5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:75

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/docs.yml:51

  • Dependency advisory GHSA-2g4f-4pwh-qvx6:pkg:e75f751e62b1e8418f7d80f3 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:72

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:15

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:19b149914c26cb2c9c5de439 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:28

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:34

  • Dependency advisory GHSA-52cp-r559-cp3m:pkg:cf5cb3ae8e56cb4261cd5e98 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-7p8r-x3mc-p8w7:pkg:936f2f623c05148e5153dbfe applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/docs.yml:34

  • Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:80dc2988b9d15a40674cea67 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-v2wj-q39q-566r:pkg:a86e21c5feeb1fab5b4a53e9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2g4f-4pwh-qvx6:pkg:cad7e9fb17eb5405be0d1fe2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:78

  • Dependency advisory GHSA-v2hh-gcrm-f6hx:pkg:65e56d3e94b4e1a92191e9c1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:18

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:130

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:131

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:1-229

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:112

  • Dependency advisory GHSA-5c6j-r48x-rmvq:pkg:9695ebfe7ac51867550b15ed applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:6159a1838ee53aace6ac3052 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:0546a3b9043a41cf17d6475f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:87

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:204

  • zizmor reported cache-poisoning · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:34

  • Dependency advisory GHSA-f886-m6hf-6m8v:pkg:3c9cac5b1efe1960955c0ea1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:106

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/docs.yml:29

  • Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3ppc-4f35-3m26:pkg:5b0d86b7147a191050fb118c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-96hv-2xvq-fx4p:pkg:788f1d7067e1308f3b84ebcc applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • Dependency advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:53

  • Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:b277e8b77a6deba5005a5469 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported template-injection · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/release.yml:55

  • Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:aa4ba74784474ac915b0530b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: package-lock.json

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:10-27

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:34

  • zizmor reported excessive-permissions · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/docs.yml:11

Contextual expected matches (16)

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

A security rule flagged a source map file, but source maps are just debug information and are not run. No actual modification to startup behavior exists.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The rule matched a source map file (file) which is not executed and has no runtime effect. Source maps are solely for debugging purposes. No actual startup-modification behavior is present in the executable bundle. This is a false positive due to pattern matching on mapping metadata.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
generated
Source
dist/index.js.map:1

zizmor reported artipacked

Expected behavior · high confidence

This workflow builds documentation and uploads it to GitHub Pages. No sensitive information like passwords or API keys is included in the uploaded files. It's a normal, safe deployment setup.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The docs.yml workflow uses actions/checkout@v4 with default token (no secrets exposed) and upload-pages-artifact@v3 for GitHub Pages deployment. No credentials are passed to the artifact step or persist beyond the workflow. The artifact contains only static Hugo build output, and the `pages: write` permission is standard for Pages deployment. No credential exfiltration path exists from the artifacts.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/docs.yml:29-31

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged regex patterns are normal parts of libraries used for formatting dates and numbers, not security issues.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: All 28 unsafe-regex signals originate from static regex patterns in bundled third-party libraries (d3-format, d3-interpolate, moment.js, recharts, fuse.js) used for legitimate purposes like date parsing, number formatting, and locale matching. No evidence of user-controlled input being passed to these regexes in a way that could cause ReDoS or injection. These are standard, well-tested patterns.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
generated
Source
dist/index.js:5506

zizmor reported artipacked

Expected behavior · high confidence

A security scanner warned about credentials being saved in build artifacts, but this step just checks out the code with no artifact upload or credential handling. There is no real risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The zizmor artipacked rule flagged this actions/checkout@v4 step as a potential credential-persistence path through GitHub Actions artifacts. However, the lint job does not upload or download any artifacts, and no GITHUB_TOKEN or other credentials are explicitly handled. The scanner match is a false positive; no artifact flow exists to expose credentials.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:15

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · medium confidence

The main JavaScript file is a bundled output created by the build process. It combines many smaller files into one, which can look messy or unfamiliar to scanners but is completely normal for web projects. There is no hidden malicious code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The generated file file is a webpack bundle containing the extension source code and dependencies like @reduxjs/toolkit, redux, immer, and reselect. The JS-X-Ray 'obfuscated-code' signal is likely triggered by webpack's module wrapper and minified vendor code, which is standard behavior for bundled JavaScript. The scanner confidence is low (0.25). There is no evidence of intentional obfuscation, concealed execution, or malicious payloads. The file is built from source during the release workflow (`npm run build`) and is structurally identical to a typical SillyTavern extension bundle.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
generated
Source
dist/index.js:1

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

The code includes protections against prototype pollution, not weaknesses. These are safety measures.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: All 5 prototype-pollution signals are defensive checks within the Immer state management library and es-toolkit utility library. The code explicitly blocks __proto__ and constructor keys to prevent prototype pollution attacks. One signal is from webpack runtime's getProto fallback which is a standard safe pattern. No actual pollution vulnerability exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.prototype-pollution
File role
generated
Source
dist/index.js:3638

zizmor reported artipacked

Expected behavior · high confidence

A security scanner warned about credentials being saved in build artifacts, but this step just checks out the code. The artifact download later does not receive any special credentials, so no risk of credential theft.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The zizmor artipacked rule flagged the checkout step in the coverage-gate job with fetch-depth:0. While this job does download an artifact, the checkout step itself does not expose credentials to the artifact. The GITHUB_TOKEN is not passed to the download-artifact action, and artifact permissions are default. No credential persistence is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:101-103

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This is a test configuration file for running automated checks during development. It reads an environment variable named 'CI' (used by build servers) to decide how strict the tests should be. No passwords, API keys, or private data are accessed or sent anywhere. This pattern is standard and harmless.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The scanner flagged process.env.CI on line 10 of a Playwright component test config file. This line reads the CI environment variable only to conditionally set test behaviors (forbidOnly and retries). No credential, secret, or user data is accessed, stored, or transmitted. The file is a development-only tooling configuration that is never shipped or executed as part of the SillyTavern extension. There is no data flow to an external destination, no serialization of any sensitive value, and no attacker-controlled input involved. The scanner signal is a false positive arising from a generic heuristic against any environment variable reference.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.serialize-environment
File role
tooling
Source
playwright-ct.config.ts:10

zizmor reported artipacked

Expected behavior · high confidence

A security scanner warned about credentials being saved in build artifacts, but this step just checks out the code with no artifact upload or credential handling. There is no real risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The zizmor artipacked rule flagged this actions/checkout@v4 step in the build job. No artifacts are used in this job, and no credentials are exposed. The scanner match is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:201

zizmor reported artipacked

Expected behavior · high confidence

A security scanner warned about credentials being saved in build artifacts, but this step just checks out the code with no artifact upload or credential handling. There is no real risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The zizmor artipacked rule flagged this actions/checkout@v4 step in the format job. No artifacts are used in this job, and no credentials are exposed. The scanner match is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:34

zizmor reported superfluous-actions

Expected behavior · high confidence

This workflow uses a community action to create a GitHub release. GitHub itself can do the same thing, but using this action isn't harmful—it's just a matter of preference. No security issue.

Technical evidence

Scanner reason: zizmor matched workflow-security rule superfluous-actions. The match applies to this repository.

Contextual assessment: The use of `softprops/action-gh-release@v1` at line 134 of release.yml is flagged as superfluous because the GitHub Actions runner includes built-in release creation capability via API. However, using a third-party action for release creation is a common practice and not a security concern. The action is well-known and open-source. No security vulnerability is introduced. The warning is about redundancy, not danger.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
superfluous-actions
File role
tooling
Source
.github/workflows/release.yml:134

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

These flagged items are React's own security features that prevent malicious URLs, not actual links.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The 8 shady-link signals correspond to React's built-in sanitizeURL function that blocks javascript: URLs, and to React's expected form action URL constant. Also includes standard namespace URIs (xmlns, xlink). None are actual outbound links to external resources. This is React's security mechanism, not a vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
generated
Source
dist/index.js:45615

zizmor reported artipacked

Expected behavior · high confidence

A security scanner warned about credentials being saved in build artifacts, but this step just checks out the code with no artifact upload or credential handling. There is no real risk.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The zizmor artipacked rule flagged this actions/checkout@v4 step in the typecheck job. No artifacts are used in this job, and no credentials are exposed. The scanner match is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:72

zizmor reported artipacked

Expected behavior · high confidence

A security scanner warned about credentials being saved in build artifacts, but this checkout step just retrieves the code and is not involved in credential handling. The artifact upload uses default permissions and has no credential exposure.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The zizmor artipacked rule flagged this actions/checkout@v4 step in the test job. Although the test job later uploads an artifact, the checkout step itself is not responsible for credential persistence, and the GITHUB_TOKEN is not explicitly passed to the artifact. The scanner match is a low-confidence false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:53

zizmor reported artipacked

Expected behavior · high confidence

This workflow creates a new release of the extension. It uses GitHub's built-in token to check out code and create the release, but never saves that token into any file that gets uploaded or shared. It's safe.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked. The match applies to this repository.

Contextual assessment: The release.yml workflow uses actions/checkout@v4 with `token: ${{ secrets.GITHUB_TOKEN }}` to fetch repository history. This is the standard way to authenticate checkout in GitHub Actions and does not expose the token outside the checkout step. No artifact upload steps exist in this workflow; the artifact warning is a false positive. The `softprops/action-gh-release` action later uses `GITHUB_TOKEN` via env, which is expected for creating releases. No credential persistence through artifacts occurs.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/release.yml:28-31

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension makes API calls to AI models and processes responses normally. There is no evidence of unsafe code execution from network data.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The file contains both network retrieval (fetch/XMLHttpRequest calls to LLM backends) and dynamic code execution (likely template literals or Function constructor used by bundled libraries). No evidence that network responses are passed to a code execution sink. The extension makes legitimate API calls to configured LLM endpoints and handles responses safely. This is standard behavior for an extension that interacts with external APIs.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
generated
Source
dist/index.js:283-95193

Coverage and limitations

Inventory
573 files · 26982910 bytes
Contextual coverage
108 of 108 candidates assessed

JavaScript coverage

Status
Incomplete
Candidates
384 files · 10606284 bytes
X-Ray review families
45 warning occurrences compacted to 5 evidence-preserving review families
Representations
384 raw · 46 decoded · 0 normalized · 0 bundle modules
Stage scans
384 raw signatures · 24 raw AST · 383 raw OpenGrep · 46 derived signatures · 0 derived AST · 46 derived OpenGrep

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity
Full commit
00d8d49c92b1ffa7bf26d4d32b534b14b5cae12e
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
11 fresh / 0 reused groups · 16 fresh / 0 reused candidates
Review source reports
none
Evidence triage
92 deterministic / 16 contextual candidates · 11 contextual / 18 total behavior cases
Model budget
5 model calls · 11 / 12 fresh cases · 186632 / 200000 estimated input · 187239 / 250000 actual input · 8648 / 40000 output tokens
Review batching
5 model calls · up to 4 groups and 6 candidates per call · 1 retry call · 0 over-budget singleton calls
Review usage
187239 input · 8648 output · 0 cache read · 0 reasoning tokens
Report
4939514f0534b0e102e10cbecace9093696b187a9432af3ee842b6cc64ef5a9d