No material or immediate-danger item was identified.
Contextual expected matches (31)
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
During setup, when testing the connection to your notes app, a link may appear to help you trust a security certificate. This link comes from the notes app itself and opens in a new tab — it's a normal setup helper.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The shady-link signal matches a single href assignment from result.certUrl in the connection test handler. This URL originates from the Obsidian REST API server response (local machine). The value is used as a window.open target to help users trust a self-signed certificate. No dynamic user input is directly injected into the href without escapping; the certUrl is server-provided. This is legitimate UI for the vault connection wizard.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ui/setup-wizard.js:374
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The warning points at a list of addresses that the code deliberately refuses to connect to. This is a protective guard against requests being sent to internal cloud services, not something dangerous.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line is part of an explicit blocklist of cloud-metadata endpoints inside a proxy-URL validator that also rejects private, link-local, and numeric-shorthand hostnames before any request proceeds. The module routes validated user-configured requests through SillyTavern's built-in CORS proxy and scrubs provider key patterns from error text. The file is marked deprecated with dispatch gated by callers. The generic link signal is explained by these defensive blocklist entries; no malicious or unexpected destination is demonstrated, and the behavior is proportional to the extension's local proxy feature.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ai/proxy-api.js:31
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · medium confidence
A security scanner thought this test file might contain hidden code, but looking at the actual file shows it's just normal unit tests with clear comments and imports. It's not used by the extension itself, so there's no risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: The JS-X-Ray scanner flagged a low-confidence obfuscation signal on a unit test file (file). However, the supplied source code shows no obfuscation—imports, test functions, and comments are all plain, readable JavaScript. The file is a test-only artifact (execution_scope: automation) and is never shipped to users. The scanner signal is likely a false positive or reflects minified/bundled code elsewhere in the project, but no actual obfuscation is present in the evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- test
- Source
- test/unit.mjs:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This diagnostic tool searches your own computer for running Obsidian vaults by testing local ports. It only ever connects to 'localhost' (your own machine). The flagged line just sets a default safe host address.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line (line 32) is a simple fallback assignment setting the host to '127.0.0.1' when no host is provided. The scanVaults function probes localhost ports to discover Obsidian instances; it intentionally hardcodes localhost as the only target. API keys are only included if the caller provides one, and requests are strictly to localhost. The static-analysis rule may have triggered due to the presence of fetch() calls nearby, but there is no vulnerability in the scanned code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/vault/scanner.js:32
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension loads its own small icon file from its own folder and puts it in the interface. This is a normal visual feature, not a way for outside code to run on your machine.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The correlated primitives are a single self-contained block: fetch of a module-relative static asset (icon.svg resolved against import.meta.url) followed by parsing that fetched text into a jQuery object that is appended to the drawer header icon. There is no dynamic code execution sink (no eval, Function constructor, or script insertion); the fetched resource is an extension-bundled SVG used as a UI icon, and jQuery parsing of an SVG document does not execute embedded scripts. The resource origin is the extension's own install path, not attacker-controlled remote input. The network retrieval and the DOM insertion occur in the same function because the SVG is intentionally loaded and rendered as the drawer's icon, matching the project's documented visual purpose. No credential, vault, or chat data flows through this path, and failure is handled by falling back to a FontAwesome icon.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- src/drawer/drawer.js:223-238
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
A security scanner thought this test file was obfuscated, but when you look at the code it's a clearly-written test that checks if the extension properly blocks dangerous file paths. The scanner was mistaken because the test code uses many small validation functions that look complex but are actually straightforward safety checks.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.
Contextual assessment: Scanner flagged an 'obfuscated-code' signal with high severity but low confidence at line 1 of the test file. The source code at that location is a multi-line JSDoc comment block followed by clear, well-structured test imports and assertions. There is no actual code obfuscation, minification, or concealment. The file contains comprehensive path validation tests with explicit assertions. The scanner likely triggered on the dense regex patterns or string manipulation in the test code, but the content is transparent and serves a security-testing purpose. The combination of high severity and low confidence from the scanner indicates a likely false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- test
- Source
- test/prompts-delete-safety.test.mjs:1
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This extension can download things and run code, but the ways it does both are separate and expected. It loads its own built-in features and talks to your local notes app — it doesn't download and execute arbitrary code from the internet.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The file contains dynamic import() statements for extension modules (vault-scan-popup.js, settings-ui.js, librarian-review.js) and network calls to local Obsidian REST API. No evidence that data received from the network is passed to eval, Function, or other code execution sink. The imports are from fixed relative paths, not from attacker-controlled URLs. The scanner correlated two broad capabilities present in the same file, but demonstrated flow is absent.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- src/ui/settings-ui.js:130-1799
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner flagged URLs in a test file, but they are harmless test addresses on your own computer. They are not used to steal data or connect to the internet.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The shady-link signal occurs on line 868 of a test file, where a template literal constructs a cache key that includes the aiSearchProxyUrl setting. The test then uses hardcoded localhost URLs (127.0.0.1:42069, 127.0.0.1:8080) as test data. These are loopback addresses used solely in automated tests to verify cache invalidation logic. No external network destinations are referenced in production code. The scanner match is a false positive from static analysis of normal configuration-building in a test context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- test/regression.test.mjs:868
zizmor reported artipacked
Expected behavior · high confidence
This is the project's automated test setup: it installs dependencies and runs checks. It never packages or uploads anything, so the warning about credentials leaking through saved artifacts does not apply to what this file actually does.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The full workflow is visible and contains only checkout, Node setup, dependency installation, tests, and linting on push and pull-request events. It creates no build artifacts, has no artifact upload step, and stores no credentials, so there is no data flow by which credentials could be persisted through GitHub Actions artifacts. The scanner match on the checkout step does not correspond to any artifact or credential handling in this file. The rule's premise is contradicted by the actual workflow contents.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/tests.yml:12
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A scanner flagged the string 'abc123' as suspicious, but it's just a simple test value used to check if duplicate entries are correctly removed. No real secrets or hidden code here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The JS-X-Ray 'encoded-literal' signal on line 712 of file matches the plain string 'abc123' assigned to entry._contentHash. This is test data used as a deterministic content hash for a deduplication test (F1-F8). The string is not encoded, obfuscated, or concealed—it is a trivial ASCII literal with no security significance. The scanner threshold for 'encoded-literal' overmatches this common test pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/stages.test.mjs:712
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
The flagged item is a list of default settings for optional AI features. The addresses point to the user's own computer for local connections, and nothing in this file shows settings being sent anywhere else.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged content is a settings schema defining connection defaults for optional AI-assisted features. Every network address present is a localhost loopback endpoint used by the extension's supported connection modes, consistent with the project's stated local-proxy design. The surrounding code performs defaults, migration, validation, and vault-primary resolution, and persists configuration through SillyTavern's settings mechanism. The scanner signal is a generic URL heuristic that matches loopback addresses; the supplied evidence shows no transmission of settings or credentials to a remote destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- settings.js:81
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · medium confidence
A security scanner thought it saw encoded text in a test file, but it's really just a simple test data object with regular text. Nothing suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: Scanner flagged a JS-X-Ray 'encoded-literal' signal at line 648 of a test file. The actual source shows a benign object literal with plain string literals (hash and manifestHash values) used as test fixture data. No actual encoding, decryption, or obfuscation is present. The scanner result is a false positive in a test context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/integration.mjs:648
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
The scanner found a string that looks like it might be encoded, but it is just a test value used to check if the code handles data correctly. There is no secret or harmful code hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The encoded-literal signal detected on line 820 of a test file corresponds to a fixed pattern such as a regex or hash string used in test assertions. The surrounding code shows tests for simpleHash function and cache key formatting, which legitimately include encoded strings and hash constants. These are static test fixtures, not runtime obfuscation or concealed behavior. No production data is affected.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/regression.test.mjs:820
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
When you click Save in the field-editing window, the extension writes your saved settings back to your own Obsidian vault on your computer. That is exactly what the button promises to do.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is the localhost default ('127.0.0.1') in a user-initiated save handler that writes custom gating field definitions to the configured Obsidian vault via the Local REST API. The call is explicit and user-triggered (clicking Save in the Rule Builder popup), the destination is the user's own local Obsidian instance, and the payload is serialized field definitions the user just edited and validated. The vault host, port, apiKey, and HTTPS preference all come from the extension's settings. This matches the project's stated purpose of managing vault-hosted configuration and does not demonstrate any exfiltration, credential mishandling, or unexpected network destination. The connection URL may be HTTP when a user configures vault.https=false, but that is the documented fallback behavior for the local plugin API rather than a security defect in this candidate.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ui/rule-builder.js:366
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test file builds a function from text to check that the privacy redaction code works correctly. It only runs during automated testing and doesn't affect the version that users run.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The test helper buildRedactAiPromptEntry uses new Function() to reconstitute the exact shipped redactAiPromptEntry function from source code extracted via regex. This is a deliberate test technique to exercise production logic that cannot be directly imported under Node.js due to static SillyTavern imports. The input is project-controlled source, not attacker-controlled, and the construct is confined to a test file (automation scope only). No dynamic execution risk in shipped behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/audit-fix-privacy.test.mjs:229
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This file handles connecting to your local Obsidian vault. It includes strong safeguards that ensure your API key can only be sent to your own computer (localhost or local network) and never to the internet. The security scanner flagged it because it uses a Bearer token, but the code has careful protection against misdirection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The scanner flagged the presence of Bearer-token Authorization header construction within obsidianFetch. However, the code is explicitly designed to prevent credential exfiltration: it calls validateObsidianHost() before building the header, which enforces a strict allowlist of loopback/LAN addresses and blocks public, metadata, and shorthand IPs. The flagged line is part of a JSDoc comment documenting this guard. All actual network requests are limited to safe local destinations as verified by the adjacent validation logic.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/vault/obsidian-api.js:32
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A security scanner found a suspicious-looking string in a test file, but it's just a made-up name like 'RKB' used to test the code that hides private info. There's no actual security issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The scanner flagged an encoded-literal signal at line 1308 in a test file. The flagged content is a plain test string ('RKB' or similar) used to construct representative trace objects for pseudonymization tests. No obfuscation or concealment is present; the literal is a simple alphanumeric test value. The file is a test module with no production execution path, and the signal represents a false positive for this context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/diagnostics.test.mjs:1308
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This line just shows a sentence like 'Probing ports X to Y on 127.0.0.1' in a popup. It doesn't send data anywhere or do anything hidden. The scanner was over-cautious because the text mentions URLs, but it's only a label.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The scanner rule 'javascript.xray.shady-link' flagged line 27 of vault-scan-popup.js, which contains a template literal that constructs a visible paragraph describing the port range being probed. The variable `opts.host` defaults to '127.0.0.1' and the port range is derived from local configuration. All interpolated values are HTML-escaped via `esc()`. This is a UI text element—no actual network request is made in this file. The 'shady-link' signal is a static pattern match that does not correspond to any malicious or concealed network access. The full source confirms the code is a popup UI that displays scan progress, results, and user instructions for trusting the Obsidian certificate. This behavior is proportionate to the project's stated purpose of scanning for local Obsidian vaults.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ui/vault-scan-popup.js:27
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The test uses a fake IP address like '192.168.1.1' to check that the privacy tool properly hides IPs. This is a normal part of testing and not a security problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The scanner flagged the literal string '192.168.1.1' on line 590 as a 'shady-link', but this is test data passed into the scrubString function to verify that IP addresses are correctly pseudonymized. The entire file exercises privacy scrubbing logic, and this test specifically validates that IP masking works. The value is a well-known private IP range used for testing, not a real or exploitable network reference.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- test/diagnostics.test.mjs:590
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A security scanner flagged a made-up ID like 'abc123' in a test file. This is just a simple example value used to check that the program correctly handles test data, not a hidden code or secret.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The JS-X-Ray encoded-literal signal at line 44 of file flags the test data string 'abc123' used as a genId in a trace object. This is a plain test value for a unit test that verifies verdict building. No encoding, obfuscation, or concealment is present. The file is a test file (execution_scope: automation) with no runtime impact on users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/verdict.test.mjs:44
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A scanner flagged the file header comment as potentially encoded, but it's just a normal description of what the tests cover. The file is a test file that checks for correct behavior; it doesn't do anything that could harm your system.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The scanner signal 'encoded-literal' at line 259 corresponds to the opening of a multi-line JSDoc comment that documents the test file. The comment contains ordinary prose describing test coverage (P2-1..P2-5 lifecycle fixes) and does not contain obfuscated strings, concealed execution, or any functionality that affects the extension's runtime behavior. The file is a test suite (file_role: test, execution_scope: automation) that exercises pure mirrors and static source guards. No encoded literal payload or malicious data flow is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/audit-fix-lifecycle.test.mjs:259
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a test that checks what happens when an Obsidian vault connection is missing its API key. The test uses a made-up local address, but no real connection is attempted. The test just verifies the software falls back to built-in prompts. Nothing harmful.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The scanner flagged a test call containing the literal '127.0.0.1' as a shady-link. This test in 'prompts-store.test.mjs' calls loadPrompts with a localhost host and port but intentionally omits apiKey, then asserts a compiled-in fallback. No actual HTTP connection is made; the function returns synchronously from a pure in-memory fallback path. The literal is a test fixture, not an active network target. No security concern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- test/prompts-store.test.mjs:598
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A security scanner thought the string 'abc123' in a test file looked suspicious, but it's just a simple test name used to check that field names can contain letters and numbers. No security risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The scanner flagged an encoded-literal signal at line 38 in a test file. The flagged content is the plain test string 'abc123' used as a valid field name in a unit test assertion. No obfuscation, encoding, or concealment is present. The file is a test module with no production execution, and the signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/fields.test.mjs:38
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A scanner thought a test string 'abcd1234' looked suspicious, but it's just a fake password used in a test to make sure the extension correctly wipes secrets before sharing diagnostic data. The test helps protect your privacy, not threaten it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The scanner signal 'encoded-literal' at line 245 is a false positive on an assertion string in a test file. The line reads assert(!out.includes('abcd1234'), 'api_key value stripped'); where 'abcd1234' is a synthetic test token used to verify that the stripUrlSecrets function correctly removes fake credentials from a URL. This is a privacy test that validates redaction, not an obfuscated literal. The file is a pure test suite (file_role: test, execution_scope: automation) that exercises privacy-related redaction functions. No actual secrets, credential exposure, or malicious behavior is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/audit-fix-privacy.test.mjs:245
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
A security scanner noticed a string that looks like a code pattern (like 'abc123') in a test file. This is just a made-up example value used to test the program's behavior, not a hidden secret or malicious code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal in this repository.
Contextual assessment: The JS-X-Ray encoded-literal signal at line 3550 of file flags a test data string '_contentHash: abc123'. This is a short alphanumeric hash used in a unit test for deduplication logic, not an obfuscated payload. The scanner likely matched the hex-like pattern of 'abc123', which is a common test value. No actual encoding or concealment is present. The file is a test file (execution_scope: automation) with no runtime impact on users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- test
- Source
- test/unit.mjs:3550
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension builds a connection to your own Obsidian program running on your computer to read its prompt files. Using your computer's local address for that is normal and expected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged literal is a localhost default host ('127.0.0.1') in a connection-builder that assembles the Obsidian Local REST API endpoint for the extension's prompt override feature. The builder returns { host, port, apiKey, useHttps, prefix } and is consumed by loadPrompts, which lists and fetches prompt override files from the user's locally running Obsidian vault. This is exactly the project's documented functionality: reading vault content from the local Obsidian REST API. The apiKey is the vault's connection token stored in extension settings, used only to authenticate these local REST calls; no evidence shows it being sent to any remote destination, logged, or persisted outside the user's own configuration. The 'shady-link' static signal is a host literal priority heuristic, not evidence of malicious or unexpected network activity.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/prompts/prompt-store.js:109
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This code simply creates a cache key from your vault settings and a scrambled version of your API key. The key is only used to store data in your own browser's local database. No data is sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The flagged line builds a local IndexedDB cache key via string interpolation of vault config values including a non-cryptographic hash of the API key. No network request occurs; the string is used solely as an IndexedDB object store key stored entirely client-side. The static-analysis rule 'shady-link' appears to have heuristically flagged the template-literal pattern but the actual data flow confirms no remote destination is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/vault/cache.js:39
Gitleaks reported generic-api-key
Expected behavior · high confidence
A security scanner flagged a line in a test file that uses a fake API key. That's expected—the test is checking whether the extension properly hides real keys. The flagged value is made-up, not a real secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks hit targets a test file (file) at line 4991, where the string '[REDACTED_SECRET:0b879cd0f14e]' is a deliberately constructed placeholder used to verify that the proxy scrubber correctly redacts Bearer tokens from error messages. The entire test suite (AI-M5-2) validates that credential redaction occurs before truncation. No real API key, token, or credential is present; the value is a test-only sentinel.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- test
- Source
- test/regression.test.mjs:4991
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
A security scanner flagged an IP address in a test file, but it's just a test that uses a local address (127.0.0.1) to check if the extension correctly rejects empty paths. No real network request was made.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Scanner flagged a 'shady-link' signal at line 177 of a test file. The code calls deletePromptFile with IP '127.0.0.1' and port 27123 as part of testing input validation for the 'cage' layer. The loopback address and test API key 'fake' are test fixtures, not actual external network connections. The scanner does not distinguish between test usage and real deployment. No external call is initiated with this test data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- test/prompts-api.test.mjs:177
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test extracts a function that strips secrets from URLs and runs it in a test environment to ensure it works properly. It's only for testing, not for users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The test helper buildStripUrlSecrets uses new Function() to reconstitute the exact shipped stripUrlSecrets function from source code. This is analogous to the sibling test helper and is used for the same reason: to exercise production logic in isolation during testing. No attacker control, no data flow to shipped code, no security impact.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/audit-fix-privacy.test.mjs:175
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The extension creates links to your Obsidian vault (running on your own computer) and to a help page for certificates. These links are made safely and only point to your local machine or external help docs.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The shady-link signal matches dynamic href construction for vault connection URLs and certificate trust links. All dynamic values are escaped via escapeHtml() before insertion into the template literal. The observed URLs point to the local Obsidian REST API (localhost) and are opened with target=_blank rel=noopener noreferrer. This is standard UI behavior for the extension's stated purpose of connecting to an Obsidian vault.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- src/ui/settings-ui.js:91