What this review found
No material or high-risk item was identified.
Minor cautions
zizmor reported excessive-permissions
Minor caution · high confidence
The test workflow does not explicitly limit what its GitHub token is allowed to do. It only needs to read code and run tests, so it should say so explicitly rather than relying on default settings.
Technical evidence
Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.
Contextual assessment: The workflow does not declare an explicit permissions block. Without one, the job inherits the repository default token permissions, which may include write scopes the test job does not need. The job only checks out code, installs dependencies, and runs tests and lint, so no write permission is required. Adding an explicit read-only permissions block would reduce the blast radius of any token compromise.
Impact: low · Exploitability: unlikely
Developer action: Add a top-level or job-level permissions block set to contents: read to restrict the GITHUB_TOKEN to the minimum scope this test job requires.
- Scanner
- zizmor 1.28.0
- Rule
- excessive-permissions
- File role
- tooling
- Source
- .github/workflows/tests.yml:9-20
zizmor reported artipacked
Minor caution · high confidence
The checkout step leaves a temporary GitHub token saved in the test runner's git settings. Since this workflow never saves or uploads those files anywhere, the risk is very low, but the token persistence can be disabled for safety.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked concern is that actions/checkout persists the GITHUB_TOKEN in the local git config of the runner workspace. If artifacts or logs capturing that directory were uploaded, the token could leak. This workflow does not upload any artifacts or publish the workspace, so the practical exposure is minimal. Setting persist-credentials: false on the checkout step would eliminate the residual risk.
Impact: low · Exploitability: unlikely
Developer action: Consider adding persist-credentials: false to the actions/checkout step to prevent the GITHUB_TOKEN from being stored in the runner git config.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/tests.yml:12
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a version label for the checkout action instead of locking it to a specific release. If that label were ever moved to a bad version, the workflow could run unwanted code. Locking to a specific version hash is safer.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is referenced by major version tag only. A tag can be moved by the action maintainer, so a compromised or retagged version could execute in this workflow. Pinning to a full commit SHA would provide immutability. This is a common practice gap in hobbyist CI and does not indicate malicious intent. The workflow runs only tests and lint with no secrets beyond the default token.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/checkout to a full commit SHA instead of the v4 floating tag to prevent supply-chain substitution.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/tests.yml:12
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a version label for the Node setup action instead of locking it to a specific release. Locking to a specific version hash is safer against supply-chain attacks.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The setup-node action is referenced by major version tag only, creating the same supply-chain substitution risk as the checkout step. The workflow context is a simple test runner with no deployment or secret handling beyond the default token, so the practical risk is low. Pinning to a commit SHA is the recommended hardening step.
Impact: low · Exploitability: unlikely
Developer action: Pin actions/setup-node to a full commit SHA instead of the v4 floating tag to prevent supply-chain substitution.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/tests.yml:13
Dependency advisory GHSA-h67p-54hq-rp68 applies
Minor caution · medium confidence
A known security issue was found in a development tool used by the project author for code quality checks. This tool is not included in the actual extension that users install, so it does not affect the safety of the extension itself.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-h67p-54hq-rp68 to a dependency declared by this repository.
Contextual assessment: The root package declares only eslint as a devDependency with no production dependencies. The flagged advisory applies to a package within the eslint development toolchain. Dev dependencies are used during local linting and are not shipped with or executed by the SillyTavern extension at runtime, so the vulnerability does not affect end users of the extension.
Impact: low · Exploitability: unlikely
Developer action: Update eslint and its transitive dev dependencies to the latest patched versions to keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-h67p-54hq-rp68
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-3jxr-9vmj-r5cp applies
Minor caution · medium confidence
A known security issue was found in a development tool used by the project author for code quality checks. This tool is not included in the actual extension that users install, so it does not affect the safety of the extension itself.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.
Contextual assessment: The root package declares only eslint as a devDependency with no production dependencies. The flagged advisory applies to a package within the eslint development toolchain. Dev dependencies are used during local linting and are not shipped with or executed by the SillyTavern extension at runtime, so the vulnerability does not affect end users of the extension.
Impact: low · Exploitability: unlikely
Developer action: Update eslint and its transitive dev dependencies to the latest patched versions to keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3jxr-9vmj-r5cp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-52cp-r559-cp3m applies
Minor caution · medium confidence
A known security issue was found in a development tool used by the project author for code quality checks. This tool is not included in the actual extension that users install, so it does not affect the safety of the extension itself.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.
Contextual assessment: The root package declares only eslint as a devDependency with no production dependencies. The flagged advisory applies to a package within the eslint development toolchain. Dev dependencies are used during local linting and are not shipped with or executed by the SillyTavern extension at runtime, so the vulnerability does not affect end users of the extension.
Impact: low · Exploitability: unlikely
Developer action: Update eslint and its transitive dev dependencies to the latest patched versions to keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-52cp-r559-cp3m
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Minor caution · medium confidence
A known security issue was found in a development tool used by the project author for code quality checks. This tool is not included in the actual extension that users install, so it does not affect the safety of the extension itself.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: The root package declares only eslint as a devDependency with no production dependencies. The flagged advisory applies to a package within the eslint development toolchain. Dev dependencies are used during local linting and are not shipped with or executed by the SillyTavern extension at runtime, so the vulnerability does not affect end users of the extension.
Impact: low · Exploitability: unlikely
Developer action: Update eslint and its transitive dev dependencies to the latest patched versions to keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Minor caution · medium confidence
A known security issue was found in a development tool used by the project author for code quality checks. This tool is not included in the actual extension that users install, so it does not affect the safety of the extension itself.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: The root package declares only eslint as a devDependency with no production dependencies. The flagged advisory applies to a package within the eslint development toolchain. Dev dependencies are used during local linting and are not shipped with or executed by the SillyTavern extension at runtime, so the vulnerability does not affect end users of the extension.
Impact: low · Exploitability: unlikely
Developer action: Update eslint and its transitive dev dependencies to the latest patched versions to keep the development environment current.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- package-lock.json
Expected scanner matches (3)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that pulls a privacy-protection function out of the project's own source code and runs it in isolation to verify it correctly removes passwords and API keys from URLs. The dynamic execution only touches the project's own code, not anything from users or the internet.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged dynamic execution is a `new Function` call inside `buildStripUrlSecrets()` in a test file. The function reads the project's own `diagnostics/state-snapshot.js` source via `readSrc`, extracts the `stripUrlSecrets` function body with a regex, and evaluates it to obtain a callable reference. This is a test-isolation pattern used because the target module imports SillyTavern's `script.js` which cannot run under bare Node. The evaluated code is the project's own shipped source, not user input or external data. The test then asserts that URL userinfo credentials and token-bearing query parameters are stripped, which is a security-positive verification.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/audit-fix-privacy.test.mjs:229
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a fake token used inside a test that checks whether the software properly hides real tokens from error messages. It is not a real secret and is only used locally during testing.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value on line 4991 is a synthetic test fixture inside a regression test file. The test (AI-M5-2) verifies that the proxy scrubber redacts Bearer tokens from error messages before truncation. The placeholder token is assigned to a local variable and used only to construct a mock fetch response body; it is never sent to any external destination or persisted. The scanner matched the placeholder string because it resembles an API key pattern, but it is not a real credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- test
- Source
- test/regression.test.mjs:4991
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that extracts a redaction function from the project's own source code and runs it in isolation to confirm it properly hides private AI prompt and response text before diagnostics are shared. The dynamic execution only processes the project's own code, not external or user-supplied data.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged dynamic execution is a `new Function` call inside `buildRedactAiPromptEntry()` in a test file. The function reads the project's own `diagnostics/export.js` source via `readSrc`, extracts the `redactAiPromptEntry` and `redactedLen` function bodies with regexes, and evaluates them to obtain a callable reference. This is a test-isolation pattern used because the target module imports SillyTavern's `script.js` which cannot run under bare Node. The evaluated code is the project's own shipped source, not user input or external data. The subsequent tests verify that AI prompt bodies, user messages, and model responses are redacted before export, which is a security-positive verification.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/audit-fix-privacy.test.mjs:175