TavernKeeper Scan Report

Finn-Hecker/RyokanApp

Commit a5bdff0 Reviewed Sep 13, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 20 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (20)

Dependency advisory RUSTSEC-2025-0080:pkg:d9db6230dfa23e8ba0fa93cf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0104:pkg:7e658c07c48d9d2faf042606 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0134:pkg:097221ca551c5a36ea9650f1 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0204:pkg:33c0cae0e4dbc28ee9aceeac applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-pxg6-pf52-xh8x:pkg:6da1e3539f31ff57c2a349c3 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory RUSTSEC-2024-0370:pkg:9b268f40461da81c7a1c55ed applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-wrw7-89jp-8q8g:pkg:4b30aae73f1836d87a5b008c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0258:pkg:95f9173f3d1ac6374e456fa8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0221:pkg:44eb386acc1a4f9a94166f13 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0081:pkg:5c764120c78ffcfe5027b39c applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-82j2-j2ch-gfr8:pkg:96123c5b487f527f8d0800cf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0098:pkg:2cf644dbdab1acf4454363df applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2024-0429:pkg:d2e88fc02f6be9987f66e6e8 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2026-0099:pkg:785327dcda385fd054101702 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-xgp8-3hg3-c2mh:pkg:313321f0eff461a0ed69a98d applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0100:pkg:bd8adf60c37242745cb633a0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0075:pkg:3e15a087e2f1d00bbc8d944a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2025-0098:pkg:bc6e2fc910a7ca702c31e56a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory GHSA-965h-392x-2mh5:pkg:f53b69f7659a4af07ac9fa2b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock
Dependency advisory RUSTSEC-2024-0436:pkg:ebf877986b5b24c5e0b97624 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: src-tauri/Cargo.lock

Coverage and limitations

Inventory: 206 files · 4295466 bytes
Contextual coverage: 20 of 20 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 25 files · 109812 bytes
X-Ray review families: 0 warning occurrences compacted to 0 evidence-preserving review families
Representations: 25 raw · 3 decoded · 0 normalized · 0 bundle modules
Stage scans: 25 raw signatures · 6 raw AST · 25 raw OpenGrep · 3 derived signatures · 0 derived AST · 3 derived OpenGrep

Unresolved JavaScript stages

src/lib/components/editor/character/characterLogic.ts — raw-ast / parse
src/lib/components/editor/worldinfo/worldInfoLogic.ts — raw-ast / parse
src/lib/data/characters.ts — raw-ast / parse
src/lib/data/worldInfo.ts — raw-ast / parse
src/lib/stores/appState.svelte.ts — raw-ast / parse
src/lib/stores/characterStore.svelte.ts — raw-ast / parse
src/lib/stores/chatStore.svelte.ts — raw-ast / parse
src/lib/stores/multiplayer.svelte.ts — raw-ast / parse
src/lib/stores/worldInfoStore.svelte.ts — raw-ast / parse
src/lib/utils/apiParameters.ts — raw-ast / parse
src/lib/utils/characterGreeting.ts — raw-ast / parse
src/lib/utils/chatApi.ts — raw-ast / parse
src/lib/utils/chatScroll.ts — raw-ast / parse
src/lib/utils/clientLanguage.ts — raw-ast / parse
src/lib/utils/promptBuilder.ts — raw-ast / parse
src/lib/utils/renderMessageMarkdown.ts — raw-ast / parse
src/lib/utils/rollingSummary.svelte.ts — derived-ast / parse
src/lib/utils/rollingSummary.svelte.ts — normalize / parse
src/lib/utils/rollingSummary.svelte.ts — raw-ast / parse
src/lib/utils/settings.ts — raw-ast / parse
src/lib/utils/tokenCount.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: a5bdff0b3fe865b3b70d18c8f9860148812ea30f
Completed: Sep 13, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: Not used — deterministic policy
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 0 fresh / 0 reused groups · 0 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 20 deterministic / 0 contextual candidates · 0 contextual / 4 total behavior cases
Model budget: 0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage: 0 input · 0 output · 0 cache read · 0 reasoning tokens
Report: 3b96fa61e9f3b6052fa838173d063b54d83331cd4d3bf88229df4abc9ba9b327