No material or immediate-danger item was identified.
JavaScript analysis reported javascript.download-to-execution
Minor caution · medium confidence
The extension can fetch data from the internet and also shows editable content in a popup. If a memory file contained malicious code, it could run in the popup. However, only you (or the extension) can edit those files, so the risk is very small.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The file contains both network retrieval primitives (fetch calls for provider APIs and file verification) and a dynamic HTML injection sink ($().html() in the previewConversion dialog). The HTML content is built from memory blocks that originate from Data Bank files. While the project uses escapeHtml elsewhere, the renderConsolidatedCards function is not shown in the evidence. If user-controlled file content is rendered into the DOM without sanitization, an XSS vector exists. However, in the SillyTavern threat model, Data Bank files are only writable by the user or the extension itself; an attacker would need prior filesystem access. The risk is self-contained and low severity. The scanner's correlation is high severity but this is a common UI pattern in extensions, and the evidence does not demonstrate active exploitation or unsanitized content.
Impact: low · Exploitability: unlikely
Developer action: Review the renderConsolidatedCards and buildConversionDialog functions to ensure that all user-originated content is properly HTML-escaped before being inserted into the DOM. Consider using textContent or safer templating methods instead of innerHTML where possible.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:923-1210
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This part of the extension uses a pattern to remove markdown tables from messages. The pattern can be slow on some carefully crafted inputs, which could make your browser tab freeze for a moment. This is not a security danger (no data theft or permanent damage), but it could be annoying if someone sends a very confusing message with lots of table characters.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex `/\|[^\n]*\|(?:\n\|[^\n]*\|)*/g` used on line 387 to strip markdown tables has potential for catastrophic backtracking (ReDoS) when processing crafted input containing many pipe characters without proper newline separators. While the pattern is not deeply nested, the outer repetition group combined with the global flag could cause polynomial-time backtracking on pathological strings (e.g., a long sequence of pipes without newlines). In the SillyTavern extension context, this function is applied to chat message text from users or LLMs, which could be attacker-controlled. A successful ReDoS would cause the browser tab to hang temporarily, a recoverable denial of service. No sensitive data is exposed, and no code execution is possible. The risk is low because the impact is limited to client-side performance degradation.
Impact: low · Exploitability: plausible
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- lib.js:387
Expected scanner matches (29)
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test tool reads a temperature setting from the environment to control how creative the AI behaves during testing. This is normal and expected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: Line 33 reads TEST_LLM_TEMPERATURE from the environment for test configuration. This is a standard, non-sensitive environment variable used only for test setup and is proportional to the test utility's purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/integration/llm-client.js:33
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a pattern-matching line used by a developer tool to find translatable text in the extension's own code. It's not used while chatting and no outsider can feed it bad input, so it's harmless.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 83 matches data-i18n attributes with proper escaping. JS-X-Ray flagged it as 'unsafe-regex' due to potential catastrophic backtracking, but it operates only on the extension's own source files (settings.html, file, editor.js) during developer tooling. No external or untrusted input reaches this regex; the input is the project's own static code. Therefore, even if a ReDoS vulnerability exists in theory, it cannot be triggered by an attacker in practice.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- tooling
- Source
- scripts/extract-strings.js:83
Gitleaks reported generic-api-key
Expected behavior · high confidence
This alert is a false alarm. It flagged a French translation of 'Show/hide API key' — just a label for a button in the settings. There's no actual API key or secret here, just words.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The Gitleaks scanner flagged line 378 of the French locale file (file) which contains the translation 'Afficher/masquer la clé API' for the English UI string 'Show/hide API key'. No actual API key, credential, secret, or token is present. The match is a false positive triggered by the presence of the substring 'API key' in the English source string, which is a legitimate UI label for a toggle visibility button. Localization files contain no executable logic, no network calls, and no user-configurable secrets.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378
Credential access and network transmission in one file
Expected behavior · high confidence
This is just a test helper that talks to a local AI server on your own computer. It's not stealing anything—it's part of a plan to write tests for the extension.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code is part of a planned test file for live LLM integration tests. It reads TEST_LLM_URL from environment variables with a default of localhost, then makes fetch calls to that URL to test memory extraction against a local LLM server. No credentials are being exfiltrated; the URL is a local development endpoint. This is standard test infrastructure and poses no security threat. The scanner flag is a false positive due to the coincidental presence of an environment variable with 'URL' and an outbound fetch in the same function.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- documentation
- Source
- docs/plans/2026-02-26-automated-testing-plan.md:610
Gitleaks reported generic-api-key
Expected behavior · high confidence
A security scanner flagged the French phrase 'Afficher/masquer la clé API' (meaning 'Show/hide API key') as if it were a real API key. It's just a translation of a button label used in the extension's settings UI, so there's nothing to worry about.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks detection on line 378 of file is a false positive. The matched text is the French translation 'Afficher/masquer la clé API' for the English UI string 'Show/hide API key'. This is a localization entry in a JSON translation file, not an actual API key or credential. No credential leakage, exfiltration, or security impact is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378
JavaScript analysis reported javascript.xray.sql-injection
Expected behavior · high confidence
The scanner thought there might be a database attack, but the code just shows a popup with fixed text. No user input is used, so there's no way for an attacker to inject anything harmful.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.sql-injection in this repository.
Contextual assessment: The scanner flagged a call to callGenericPopup as a potential SQL injection, but the code at line 9936 passes a fully static HTML string (batchHtml) constructed from fixed template literals and translation function calls. No user input, untrusted data, or database query is involved. The extension does not use SQL at all; it operates entirely within SillyTavern's client-side APIs and Vector Storage. The scanner signal is a false positive from a generic pattern match.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.sql-injection
- File role
- production
- Source
- index.js:9936
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a false alarm. The scanner got confused by the words 'API key' in a French translation of a user interface label. There is no real password or secret key here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule flagged line 378 of file which contains the UI label translation '"Show/hide API key": "Afficher/masquer la clé API"'. This is a static localization string, not an actual credential. The pattern match is a false positive caused by the literal phrase 'API key' appearing in the English source text. No API key, token, or secret value is present anywhere in this file.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378
Credential access and network transmission in one file
Expected behavior · high confidence
This test file uses an optional API key from your computer's settings to talk to the language model you chose, which is exactly what it's supposed to do. It doesn't send the key anywhere else.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: This test helper reads an API key from the TEST_LLM_KEY environment variable and sends it as a Bearer token to the user-configured LLM endpoint. Both the key source and the network call are necessary for authenticating to the LLM during integration tests. The destination is the URL specified by TEST_LLM_URL, not a fixed or unknown host. There is no exfiltration or diversion; the pattern matches standard LLM client authentication. This is expected behavior for a test helper.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- test
- Source
- test/integration/llm-client.js:48
Credential access and network transmission in one file
Expected behavior · high confidence
The code looks like it uses an API key to talk to a language model — and that's exactly what it's for. It's a test that developers can run on their own computer to check that a new feature works. The key comes from a secret environment variable (not hardcoded), and it only goes to the model server the developer chose. This is normal and safe for testing.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged code is a proposed live integration test file (not shipped to users) that reads an LLM API key from the environment variable TEST_LLM_KEY and passes it as a Bearer token in an HTTP POST to the LLM endpoint specified by TEST_LLM_URL (defaulting to a localhost address). This is standard practice for making authenticated requests to external LLM APIs during local testing. The credential source (environment variable) and network sink (fetch to the user-specified LLM URL) are both visible, intentional, and proportionate to the purpose of testing chunked memory consolidation against a real LLM. The test is not packaged or executed in production; it only runs when a developer explicitly invokes it with a local LLM server. There is no evidence of exfiltration, hidden transmission, or credential abuse.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- documentation
- Source
- docs/superpowers/plans/2026-04-23-chunked-consolidation.md:708
OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network
Expected behavior · high confidence
This test file uses an optional API key from your computer's settings to talk to the language model you chose, which is exactly what it's supposed to do. It doesn't send the key anywhere else.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: This test helper reads an API key from the TEST_LLM_KEY environment variable and sends it as a Bearer token to the user-configured LLM endpoint. Both the key source and the network call are necessary for authenticating to the LLM during integration tests. The destination is the URL specified by TEST_LLM_URL, not a fixed or unknown host. There is no exfiltration or diversion; the pattern matches standard LLM client authentication. This is expected behavior for a test helper.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.credential-exfiltration.javascript-secret-to-network
- File role
- test
- Source
- test/integration/llm-client.js:48
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The test tool reads a web address from the environment to know where to send test requests. The default address points to your own computer, which is safe.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Line 19 reads TEST_LLM_URL from the environment, defaulting to a localhost endpoint. This is a legitimate test configuration value and the URL is not obfuscated or pointing to an untrusted external server by default.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- test/integration/llm-client.js:19
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
Another pattern used by a developer tool to find translatable strings. It only runs on the project's own files, not on anything a user types, so it's safe.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 176 matches t`...` template literal keys for i18n extraction. It contains nested groups and lookaheads that a static analyzer may flag as unsafe, but it is only executed against the project's own source files during the string extraction tool run by the developer. No untrusted input is processed, so no attacker can exploit any ReDoS weakness.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- tooling
- Source
- scripts/extract-strings.js:175
OpenGrep reported tavernkeeper.credential-exfiltration.javascript-secret-to-network
Expected behavior · high confidence
This test file uses an optional API key from your computer's settings to talk to the language model you chose, which is exactly what it's supposed to do. It doesn't send the key anywhere else.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network in this repository.
Contextual assessment: This test helper reads an API key from the TEST_LLM_KEY environment variable and sends it as a Bearer token to the user-configured LLM endpoint. Both the key source and the network call are necessary for authenticating to the LLM during integration tests. The destination is the URL specified by TEST_LLM_URL, not a fixed or unknown host. There is no exfiltration or diversion; the pattern matches standard LLM client authentication. This is expected behavior for a test helper.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.credential-exfiltration.javascript-secret-to-network
- File role
- test
- Source
- test/integration/llm-client.js:90-95
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
Same as candidate 3844eb — the test tool reads the server address from the environment.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: Line 19 reads TEST_LLM_URL from the environment, defaulting to localhost. This is legitimate test configuration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/integration/llm-client.js:19
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This alert is about a harmless notification message displayed to the user. It's not a security issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The 'shady-link' signal at line 1265 corresponds to a static toastr message string. The scanner's retained literal values were not provided, but the visible context shows a user-facing notification about file operations. No actual URL, network call, or malicious content is present in the supplied evidence. This is a benign UI message with no security relevance.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1265
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a harmless example URL in a text box where you type your own server address. It's not secretly connecting anywhere — it's just a hint to show you what the address should look like.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:5686
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test tool reads a setting that tells the AI model not to show its thinking steps. This is just for testing.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: Line 35 reads TEST_LLM_NO_THINK from the environment to configure reasoning model behavior. This is a non-sensitive test flag.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/integration/llm-client.js:35
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This line helps convert template expressions into translation keys. It only processes the extension's own code, not user input, so it's not a security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 158 replaces template interpolation patterns ${...} with numbered placeholders. It is part of the string extraction tool and operates only on the extension's own source code. No external input is involved, so any theoretical ReDoS vulnerability cannot be triggered by an attacker.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- tooling
- Source
- scripts/extract-strings.js:157
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension has a built-in address for a local AI server on your own computer. This is normal and safe—it does not send your data anywhere else.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:423
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test tool reads a number from the environment that limits how many words the AI can use in its response during testing.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: Line 25 reads TEST_LLM_MAX_TOKENS from the environment to set the generation budget. This is legitimate test configuration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/integration/llm-client.js:25
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This is a test helper file that reads settings from environment variables to connect to an AI model for testing. It uses an API key to authenticate, which is normal and expected. There is no secret theft or hidden behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: This test helper reads environment variables to configure an LLM client for integration testing. The variable TEST_LLM_KEY is used to set an Authorization header on requests to the configured LLM endpoint, which is the intended purpose. The scanner flagged reading process.env.TEST_LLM_MODEL (line 37) as a 'serialize-environment' signal, but reading environment variables and using them to authenticate API requests is expected behavior for a test client. No exfiltration, obfuscation, or unauthorized destination is present; all data flow is local and transparent. The file role is test, and the code is straightforward and purposeful.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/integration/llm-client.js:37
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code stores a default address for a local AI server (Ollama) when upgrading settings. It's like setting a default printer location—completely normal and not a security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:1566
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test tool reads an API key from the environment to prove it is allowed to use the AI service during testing. This is normal for any tool that talks to a protected API.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: Line 20 reads TEST_LLM_KEY from the environment, which is the API key for the test LLM endpoint. This is legitimate credential handling for a test utility that needs to authenticate to the API it tests. The key is only used in auth headers sent to the configured endpoint, defaulting to localhost.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/integration/llm-client.js:20
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
Line 5553 adds example text to a box where you type a server address. It's just an example, not an actual link or hidden network call. The extension needs this to let you connect to an AI service, which is what it's supposed to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:5553
JavaScript analysis reported javascript.credential-to-network
Expected behavior · high confidence
The test tool sends the API key to the AI service it is testing so the service knows the request is allowed. This is exactly how API authentication should work.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.credential-to-network in this repository.
Contextual assessment: The scanner correlates credential access (TEST_LLM_KEY on line 20) with outbound network calls (lines 48 and 90). This is exactly the intended behavior: the test client sends the bearer token to the configured LLM endpoint to authenticate requests. The data flow is fully contained within the test utility and the configured endpoint; there is no exfiltration to unexpected destinations.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.credential-to-network
- File role
- test
- Source
- test/integration/llm-client.js:25-48
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code just shows a placeholder example URL in a text field so users know what to type. It does not secretly send any data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:5858
Gitleaks reported generic-api-key
Expected behavior · high confidence
This alert was triggered because the word 'API key' appears in a French translation file. It's just a label for a button that lets users show or hide their API key — not an actual key. There is no security concern.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The Gitleaks alert matched the generic 'API key' pattern on line 378 of a French localization file (file). The matched content is the translation string '"Show/hide API key": "Afficher/masquer la clé API"' — a static UI label with no actual credential, secret, or dynamically sourced value. No API key or credential is present in the matched line or anywhere in the supplied file excerpts. The alert is a false positive from a pattern-based scanner that cannot distinguish translation strings from real secrets.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- locales/fr-fr.json:378
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test tool reads a timeout setting from the environment to know how long to wait for the AI to respond during testing.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: Line 29 reads TEST_LLM_TIMEOUT from the environment to configure request timeout. This is a non-sensitive test configuration value.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/integration/llm-client.js:29
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- index.js:4325