No material or high-risk item was identified.
Expected scanner matches (9)
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just a French translation of a button label that says 'Show/hide API key.' It does not contain any real password or secret key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a localization entry in a French translation JSON file. The matched text is a UI label for a show/hide toggle for an API key field. It contains no actual credential value, secret, or token. The gitleaks generic-api-key rule matched on the phrase 'API key' in the translation string, producing a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378
Credential access and network transmission in one file
Expected behavior · high confidence
This is test code that talks to a local AI model server for automated testing. It reads simple test settings (like which server address to use) from environment variables, with a safe default pointing to the user's own computer. No passwords or secret keys are involved, and nothing is sent to any outside service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code is a test helper inside a documentation file describing an automated testing plan. It reads two non-secret environment variables (TEST_LLM_URL and TEST_LLM_MODEL) that configure a test LLM endpoint, defaulting to a local loopback address. The fetch calls go to that configurable test endpoint to list models and request chat completions. No API keys, tokens, or user credentials are read, stored, or transmitted. The network destination is a developer-controlled test server, not an external or hidden endpoint. This is consistent with the stated purpose of integration testing against a local LLM.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- documentation
- Source
- docs/plans/2026-02-26-automated-testing-plan.md:610
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a translation file for the extension's user interface. The scanner flagged the words "API key" in a French translation of a button label. There is no actual secret or password here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched the phrase "API key" in a French UI translation string. The matched line is a localization entry mapping the English label "Show/hide API key" to its French equivalent. No credential value, secret, or token is present; the match is purely on the descriptive label text.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged a line in a French translation file because it contains the words 'API key'. It is just a translated button label telling users they can show or hide their API key. No actual secret is stored here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched on a French translation locale file. The matched line is a UI label string translating 'Show/hide API key' to 'Afficher/masquer la clé API'. This is a localization entry, not a credential value. No secret material is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378
Credential access and network transmission in one file
Expected behavior · high confidence
This is a test file that uses a test API key to authenticate with an LLM service for running integration tests. The key comes from an environment variable set by the developer running the tests and is sent only to the LLM endpoint they configured. This is normal and expected behavior.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: This is a test helper file that reads a test-only bearer token from the TEST_LLM_KEY environment variable and includes it in an Authorization header when calling a user-configured LLM endpoint (defaulting to localhost). The token is used solely for authenticating with the endpoint the tester explicitly configured, which is the expected and proportionate use of a credential in an integration test client.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- test
- Source
- test/integration/llm-client.js:48
Credential access and network transmission in one file
Expected behavior · high confidence
This is a test code snippet inside a planning document. It reads a test API key from the developer's own environment variables and sends it to a local test server address by default. This is normal for integration tests and does not steal or leak any user credentials.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code is inside a documentation plan file and depicts a live integration test. It reads TEST_LLM_URL, TEST_LLM_MODEL, and TEST_LLM_KEY from environment variables, defaulting the URL to localhost and the key to empty. The fetch call sends the key only when present, to a developer-configured endpoint that defaults to a local LLM server. This is standard test harness behavior: credentials are test-scoped, sourced from the local environment, and transmitted to a developer-controlled destination. There is no access to SillyTavern user credentials, no hardcoded third-party endpoint, and no concealed exfiltration path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- documentation
- Source
- docs/superpowers/plans/2026-04-23-chunked-consolidation.md:708
OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network
Expected behavior · high confidence
The scanner flagged this because an API key and a network request appear in the same file. In context, the key is a test credential used to authenticate with the LLM service the developer chose for running tests. It is not sent anywhere unexpected.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: The scanner matched because a credential source (TEST_LLM_KEY read from environment) and a network sink (fetch call) appear in the same file. However, the credential is a test bearer token used only in an Authorization header to authenticate with a user-configured LLM endpoint for model discovery. The destination defaults to localhost and is fully controlled by the tester via TEST_LLM_URL. There is no exfiltration to a third party, no hardcoded external endpoint, and no obfuscation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.credential-exfiltration.javascript-secret-to-network
- File role
- test
- Source
- test/integration/llm-client.js:48
OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network
Expected behavior · high confidence
This is the main test function that sends a prompt to the LLM service using the test API key for authentication. The key is used exactly as intended — to call the LLM endpoint the developer configured for testing — and goes nowhere else.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: This candidate covers the chat completions fetch call, which includes the same authHeaders() containing the test bearer token. The request goes to the user-configured TEST_LLM_URL (defaulting to localhost) and is the core function of this integration test helper: calling an LLM to validate the extension's extraction logic. The credential is used proportionally for its stated purpose with no indication of hidden destinations or exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.credential-exfiltration.javascript-secret-to-network
- File role
- test
- Source
- test/integration/llm-client.js:90-95
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a translation of a button label that mentions an API key. It does not contain any actual secret or password — just the words describing a show/hide toggle.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key match is on a French translation locale entry for a UI label about showing or hiding an API key. The line contains only translated display text and no credential value, secret, or variable holding a secret. No data flow, exfiltration, or execution is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378