No material or immediate-danger item was identified.
Expected scanner matches (15)
Credential access and network transmission in one file
Expected behavior · high confidence
The extension gets a security token from SillyTavern and uses it to upload images back to SillyTavern's own server. This is the normal, expected way extensions communicate with SillyTavern. No credentials are sent anywhere outside the user's own SillyTavern setup.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code retrieves a CSRF token via getCSRFToken() and immediately uses it in a fetch POST to the SillyTavern server's image upload endpoint (API_BASE + ENDPOINTS.IMAGES_UPLOAD). This is a standard same-origin authentication pattern for SillyTavern extensions calling the local server API. The token is not logged, stored externally, or transmitted to any third-party destination. The request body contains base64-encoded media data and a filename, matching the stated project purpose of downloading and saving embedded character media. There is no credential exfiltration: the CSRF token is used solely for its intended purpose of authenticating a request to the host SillyTavern instance.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- app/library.js:22946
OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network
Expected behavior · high confidence
The code makes a local network call to check whether a browser it just started is responding. It only asks for the browser's version number and prints it to the screen. No passwords, API keys, or personal data are sent anywhere.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: The flagged fetch at line 241 targets the loopback address on a local relay port to retrieve Chrome DevTools Protocol version metadata. It is a diagnostic poll that retries up to 15 times to confirm the headless browser launched successfully. The response contains browser version and user-agent strings, which are printed to the console for the user. No credentials, tokens, or session data are passed as request body, headers, or URL parameters to this endpoint. The destination is strictly local. This is consistent with the stated purpose of a JanitorAI browser relay launcher.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.credential-exfiltration.javascript-secret-to-network
- File role
- production
- Source
- extras/janitorai-browser/run-browser.mjs:241
Credential access and network transmission in one file
Expected behavior · high confidence
The code gets a security token from SillyTavern and uses it to send an avatar update to SillyTavern's own server. This is exactly how extensions are supposed to talk to SillyTavern. The token is not sent anywhere outside the user's own SillyTavern instance, so there is no credential theft or suspicious behavior here.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code retrieves a CSRF token via CoreAPI.getCSRFToken() and includes it in an X-CSRF-Token header for a POST request to the same-origin endpoint /api/characters/edit-avatar. This is the standard SillyTavern pattern for authenticating local server API calls. The token is not transmitted to any external destination; it is sent only to the SillyTavern server on the same origin. The separate fetch of avatarUrl retrieves an image blob to apply as a character avatar, which matches the extension's stated purpose of version history and avatar management. No credential exfiltration or concealed outbound transmission is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- modules/character-versions.js:1467
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just the name of a toggle setting in the extension's options menu. It is not a password or secret key, despite the scanner flagging it because the setting name contains the word API.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a settings definition object whose key property is the string literal used as a configuration identifier for a boolean checkbox. It is not a credential, token, or secret. The scanner matched on the substring pattern because the key name contains the word Api, but no sensitive value is present or transmitted.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- modules/providers/chub/chub-provider.js:579
Gitleaks reported jwt
Expected behavior · high confidence
This is a public app key meant to be included in client-side code, similar to a public API identifier. It is not a secret password and is intended to be visible. The scanner flagged it because it looks like a token, but it is safe to ship.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule jwt in this repository.
Contextual assessment: The matched value is a Supabase GoTrue anon publishable key used as the apikey and Bearer header for JanitorAI authentication requests. Supabase anon keys are designed to be embedded in client code and are enforced by row-level security, not secrecy. The source comment documents this intent, and the key is used solely to reach the public auth token endpoint. No private credential or user secret is exposed.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- jwt
- File role
- production
- Source
- modules/providers/janitor-session.js:6
Credential access and network transmission in one file
Expected behavior · high confidence
The code fetches avatar images from remote character providers and then uploads them to the local SillyTavern server to restore avatars. A security token is included in the local server request, which is exactly how such tokens are supposed to be used. No passwords or secret keys are sent to any outside service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The scanner flagged co-occurrence of a credential source and a network sink. On inspection, the CSRF token obtained via CoreAPI.getCSRFToken() is sent only to the local SillyTavern server endpoint /api/characters/edit-avatar (line 330-334), which is the standard and intended use of a CSRF token for same-origin API requests. The remote fetch on line 320 uses fetchWithProxy with c.remoteUrl to download an avatar image and does not include any credentials or tokens in its request. The value on line 302 is an operation-cancellation token compared against opToken, not a secret. No credential is transmitted to any external destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- modules/providers/datacat/datacat-avatar-restore.js:330
Credential access and network transmission in one file
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- modules/batch-transfer.js:893
Gitleaks reported jwt
Expected behavior · high confidence
The scanner flagged a value that looks like a login token, but it is actually a public key that JanitorAI's backend service expects to be included in client apps. It is not a secret password and is designed to be visible in code. The real security is handled by the server, not by hiding this key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule jwt in this repository.
Contextual assessment: The flagged value is a Supabase anon (publishable) key used as the apikey and Bearer token for GoTrue authentication against JanitorAI's Supabase backend. Supabase anon keys are JWT-formatted by design, which triggers the gitleaks JWT rule, but they are intended to be embedded in client-side code and are not secret credentials. Access control is enforced server-side via Supabase row-level security policies, not by keeping this key private. The key is used only for the stated purpose of authenticating to the JanitorAI session endpoint.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- jwt
- File role
- production
- Source
- modules/providers/janitor-session.js:6
Credential access and network transmission in one file
Expected behavior · high confidence
The code grabs a security token that SillyTavern itself provides and uses it to send the edited character picture back to SillyTavern's own server. This is normal and expected behavior for an extension that saves character avatars. Nothing is sent to any outside service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code retrieves a CSRF token via CoreAPI.getCSRFToken() and includes it in an X-CSRF-Token header on a POST request to the relative endpoint /api/characters/edit-avatar. This is a same-origin request to the local SillyTavern server for uploading an edited character avatar image. The CSRF token is a standard anti-forgery mechanism used for its intended purpose and is not transmitted to any external destination. No API keys, model-provider credentials, or user secrets are accessed or exfiltrated. The data flow is proportionate to the stated project purpose of editing and saving character cards.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- modules/character-creator.js:3354
Credential access and network transmission in one file
Expected behavior · high confidence
The code gets a security token and uses it to ask the local SillyTavern server for a list of images in a character's gallery. The token stays on the local server and is used exactly as intended. Nothing is sent to any outside service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The scanner flagged co-occurrence of a credential source and a network sink. The credential is a CSRF token obtained via getCsrfToken and used in the X-CSRF-Token header for a fetch to a relative path /api/images/list on the local SillyTavern server. This is the standard authentication pattern for SillyTavern extension API calls. The token is not transmitted to any external destination, is used for its intended purpose, and the call retrieves gallery file listings which matches the project's stated character library management purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- index.js:1387
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a search key for a public character-browsing website. The website itself publishes this key in its own public web page code. The extension uses it to search for characters, which is exactly what the extension is designed to do. It is not a personal password or secret key and does not access your private data.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a MeiliSearch search API key for JannyAI's public character search endpoint. The code at getSearchToken() first attempts to scrape this key from JannyAI's own client-side JavaScript bundle, then falls back to the hardcoded value if scraping fails. This key is embedded in JannyAI's public website client code and authorizes read-only searches of a public character database. It is not a user credential, not a paid-service API key, and grants no access to user data or host state. Its use is proportionate to the extension's stated purpose of browsing online character providers.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- modules/providers/janny/janny-api.js:13
Credential access and network transmission in one file
Expected behavior · high confidence
The scanner noticed that this file both touches login-related browser data and makes a network call. However, the network call in question only asks a locally running browser for its version number. It does not send any login information or secrets to any external server.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: This candidate flags the co-occurrence of credential-related code and a network sink in the same file. The specific network call at line 241 is a loopback fetch to a local Chrome DevTools Protocol endpoint for version metadata only. The file does handle browser session state as part of its JanitorAI relay purpose, but the flagged fetch does not transmit credentials. The relay binds to a configurable address, and the code explicitly warns users when the bind is not loopback. No exfiltration path exists at this call site.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- extras/janitorai-browser/run-browser.mjs:241
Gitleaks reported jwt
Expected behavior · high confidence
This is a public key meant to be included in front-end code, similar to a public API identifier. It is not a private password or secret token, and using it here is normal and expected for the feature being built.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule jwt in this repository.
Contextual assessment: The matched value is a Supabase publishable anon key (role:anon) used as the apikey header for client-side GoTrue authentication against JanitorAI's Supabase endpoint. Supabase anon keys are designed to be embedded in frontend bundles and are not secret credentials; they only grant access permitted by Row Level Security policies. The code comment documents this, and the key is used solely for the stated purpose of JanitorAI account auth to unlock additional sort pages. The scanner already redacted the value.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- jwt
- File role
- production
- Source
- modules/providers/datacat/datacat-api.js:272
Gitleaks reported gcp-api-key
Expected behavior · high confidence
This is a type of API key that Google Firebase specifically designs to be included in front-end code. It identifies which Firebase project to talk to but does not unlock any data on its own. It is being used normally to let users log in to the Wyvern character-sharing service. This is a standard and expected pattern, not a leaked secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule gcp-api-key in this repository.
Contextual assessment: The matched value is a Firebase Web API key used to construct Google Identity Toolkit endpoints for password sign-in and token refresh against the Wyvern platform's Firebase backend. Firebase Web API keys are designed by Google to be embedded in client-side applications; they identify a Firebase project but do not by themselves grant data access. Firebase enforces access control through authentication and Security Rules, not through API key secrecy. The key is used solely to call Google's public identity toolkit endpoints for authenticating users of the Wyvern service, which is consistent with the extension's stated purpose of browsing and downloading characters from online providers. The only theoretical abuse is quota or billing manipulation against the Wyvern service itself, not against the extension user.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- gcp-api-key
- File role
- production
- Source
- modules/providers/wyvern/wyvern-api.js:17
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a public search key for a free character-browsing website, baked into the website's own frontend code. The extension tries to grab the latest key from the website first, and only uses this built-in copy as a backup. It only lets the extension search the public character directory. It is not a password or private key and does not put any user data at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a hardcoded fallback MeiliSearch search token for the public JannyAI character search service. The code first attempts to scrape the current token from the site's client-config JS bundle and only uses this fallback if scraping fails. This token is a public, client-side search API key embedded in the site's own frontend JavaScript; it is not a user credential, paid-service API key, or private secret. It authorizes read-only search queries against a public character directory. No user data, credentials, or sensitive state is exposed by its use.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- modules/providers/janny/janny-api.js:13