TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

horizonfps/project-lunar

Commit 20a284e Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 182 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (166)

  • Dependency advisory GHSA-4jcj-7x88-m979:pkg:6edccc428b47a23b0683f327 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-6wvf-77m9-58rm:pkg:1ffc148ad960d83cc7640784 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:09f761f2e2a83fdc7890eb5a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-f22v-gfqf-p8f3:pkg:e02092e316c0f01f87be61f0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-5c9x-8gcm-mpgx:pkg:52ed0bcc50fc67c13bc1a0f1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-wrjc-x8rr-h8h6:pkg:a6d5072ae044ea6a8620874b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-337j-9hxr-rhxg:pkg:c6b81fdb91063d187bf1802a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-4067:pkg:61be4b810ab858cb9efc7860 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:06e609558382e589a31815a6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

    Source: frontend/vite.config.js:13

  • Dependency advisory PYSEC-2026-3479:pkg:026901ad5889a3c4667f9fde applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-3v7f-55p6-f55p:pkg:6567e5dee65459862e18aa65 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-g5pg-73fc-hjwq:pkg:59ca2fc666c0c65daa2ec70e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-6chq-wfr3-2hj9:pkg:946baee5f67111f229dd9e04 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-j8rh-479h-cp32:pkg:b808ce488de43ba9a89c9945 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-m7pr-hjqh-92cm:pkg:3d0605aeb544e0431c82ba7a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-6j4f-fj2g-mc7p:pkg:7efd487b77ed76343c7e445e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-vfj7-8cjw-p6xm:pkg:efd3ff768f6f1133cf11c41f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-g7r4-m6w7-qqqr:pkg:3f0bdf982e62a6497b1e7d21 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-6jv3-5f52-599m:pkg:f080cc8c69401251820e2e10 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-3038:pkg:8c302df415f37b7a8bdce01b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-3039:pkg:14680a7b42525bf94071e12c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-4x5r-pxfx-6jf8:pkg:25699e8af93adc546e42c0c5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-w9j2-pvgh-6h63:pkg:b268e93ea5768eed0d01e4b2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-390:pkg:c1205d0bae8302daa7d187cf applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-xx6v-rp6x-q39c:pkg:3539191e7a13253e50ae6c7e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-5rvq-cxj2-64vf:pkg:86773285863dfc77c95412e5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-p9ff-h696-f583:pkg:fe2ab2404670af8c9c875487 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-4075:pkg:251de29316fae00ae13bb1a4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-1851:pkg:4931fe8c489a671e86516895 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-mf52-j94g-746m:pkg:370c8c8117d7ba50599e7cad applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-6qr3-3g89-m4jj:pkg:905cda02ca7e1b3c2844ad59 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-1547:pkg:016b8c49d084a3a328660ba0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-3cv6-jpf6-8222:pkg:0b1ca80f00b6d262bc3d0916 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-4070:pkg:49dba72ce062f489c27dab3e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-2270:pkg:88ff04df9ed742352e55b924 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-f23m-r3pf-42rh:pkg:1e24b9b23aad422ff7716e9f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-1548:pkg:f94276e8d3ce6db6a2ef4589 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-2597:pkg:f957b4fd6b1ca17d78c646c7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-4066:pkg:7163a527068a7e5f62b49396 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-pf86-5x62-jrwf:pkg:10392515b444d9fdfd20226e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-r4q5-vmmm-2653:pkg:4d011bc6f59fd39864ec62aa applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-35jp-ww65-95wh:pkg:2c37ac82972153bfa1d632bc applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-v9pg-7xvm-68hf:pkg:f9806f0dcc79a81601eccc23 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-49rj-9fvp-4h2h:pkg:917d731e32622b0865117731 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-3040:pkg:02e6df712480e1ce9652cf54 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-4069:pkg:3a866173a13e264a675faefa applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-3036:pkg:a49d089bcf8003a0ddf40bb9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:56fd66430fa2724b4206a4ad applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-g26j-5385-hhw3:pkg:e0faf47452baf43e77db63df applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-42h9-826w-cgv3:pkg:f9706db8c14cfe5a52dfed7a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-2v37-7h3g-55p8:pkg:a9b17cadf83e3a5de547592b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-3pq3-5fj3-cg6v:pkg:3bf3b7d5debab249a4897a3c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-rj75-hqrm-r3gf:pkg:b2fbfa517ffc8de3a99c3c56 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-p897-vf7j-f5h8:pkg:d850ee1e26c69f525b489a5b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-hx8v-g79f-8w5f:pkg:db52a45f4edc447163dd6531 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-84g9-w2xq-vcv6:pkg:f93274838750a0fe40a1004d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-445q-vr5w-6q77:pkg:1864c89582f40aa9e4aa6216 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-fvcv-3m26-pcqx:pkg:e3d3a115239ca8273eaf1fdb applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-4071:pkg:918090a7d350c627b65e6e4a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-1543:pkg:0ffcd3c20636b9e5f3263cb4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-w2mh-qq9q-453x:pkg:c4d7555c57fb45cfe8239ca1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-fh2c-86xm-pm2x:pkg:1a86e949a81b4640813db424 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-qx2v-qp2m-jg93:pkg:993938275fd8c839d24348ad applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-w9m9-85wc-3x92:pkg:789fe9d4eb26f7c51d684509 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-777c-7fjr-54vf:pkg:af944a612c4e2edfb252523a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-qwww-vcr4-c8h2:pkg:c4a82d732ba9e6784a8058cb applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:f943bf04aa1d0078992a0950 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-rj75-hqrm-r3gf:pkg:1d32965290ef0cbb294fca1b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-v2wj-q39q-566r:pkg:a86e21c5feeb1fab5b4a53e9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-qrc4-49gv-mv9m:pkg:1e799a6b6f3d7ebaf6119262 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-q8qp-cvcw-x6jj:pkg:73eb7c98ea78cd7427d7b2ab applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-c693-x898-5g4h:pkg:03da53f68888f54ccfd66b39 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-fjcf-3j3r-78rp:pkg:b53a4e83ec0001a084d3d912 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-r5fr-rjxr-66jc:pkg:b56b7b458d7b28a4fe45146c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-388:pkg:feb0d42d0b1cec0abed1f7b0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-5p4m-2wfm-xmqj:pkg:a2732cf17ea59b7c9ad7dcba applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-4xpc-pv4p-pm3w:pkg:163fb03ab99b940df48e109d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:a6af0e9fdfc814bb2702c837 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-j37q-q7p9-vpwm:pkg:f1293a55b6799fb2e1acab81 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-3861:pkg:c0cb69c2c6b22f8e88c43482 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-qmf3-4767-5fg3:pkg:4918d2264fb6c971897dc3cc applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-4073:pkg:c1bd91b74670e3c48eb4c1c1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:b277e8b77a6deba5005a5469 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-9fr6-4gfg-395g:pkg:f527b0c62c3e082fd1415b91 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-52cp-r559-cp3m:pkg:cf5cb3ae8e56cb4261cd5e98 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-3477:pkg:c7625a6553e7078b5d215b28 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-68fv-2mgg-jv7q:pkg:9534329f616dc744f00f37e0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-3037:pkg:74b9228c64f62bb86c4528ab applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-542g-h47m-68v8:pkg:a37abab6e8be9aaed7496f13 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:ed41a2fd10becce80f384db1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-p92q-9vqr-4j8v:pkg:9847ed6129fd0eba6bbcb13a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-59g5-xgcq-4qw3:pkg:a1ec7327f2d984608322efc5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-62hf-57xw-28j9:pkg:a15343d2ef7d2d7c6d1da5ec applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-4076:pkg:963d918ced81eebc097e2ac0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-3g43-6gmg-66jw:pkg:0ce38d0e7c920c3469a177f1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-4068:pkg:7cc9ef01abf34f58377bb8f1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-3v7f-55p6-f55p:pkg:972939a004a2a625fbda61c7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-879v-fggm-vxw2:pkg:42359d09f3f4f29393052eca applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-4074:pkg:94fdaf09da06727164a1a7ff applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-gw2q-qw9j-rgv7:pkg:fcca0a5215347ab26ffc7841 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-pp6c-gr5w-3c5g:pkg:a5b9ad4a61e6d59c054ec7b5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-6g55-p6wh-862q:pkg:48ce53e19d4b406f8f9515a3 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-wp53-j4wj-2cfg:pkg:2186f7443db0c80e8275be19 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-rf6f-7fwh-wjgh:pkg:7f7b5fd77db622ab6aa9659b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-rxv8-25v2-qmq8:pkg:4483aab29ff219c3c7da7877 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-jjhc-v7c2-5hh6:pkg:1e461363074b843eb75778c2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-mmx7-hfxf-jppx:pkg:6ded41f702f95eb7af5981a1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2024-38:pkg:a9a718b14aa7b2f685265105 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: proxy/requirements.txt

  • Dependency advisory GHSA-q2hr-2g5m-vwhr:pkg:da7ae0dc6dfdcfb10b537116 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-2600:pkg:11538748cb0aad2d1f2fab87 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-vf2m-468p-8v99:pkg:19241a720b925556c97e6801 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-vh66-26gq-q6x8:pkg:efa8478b31f0dfff223abca9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-h8fp-f39c-q6mh:pkg:5e3fdb548f608e7620fd6077 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-1545:pkg:4e2f1ab9d90f3eb82e25dbb2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-7488-6r32-c95q:pkg:eef79ffcc6687a0bb1601837 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-w5vr-8v7q-w6rv:pkg:98d82efcc5a7a6ead7b6d0c4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-73wf-gq98-2v4g:pkg:6081c99555a9c657812a9448 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-2883-xcg3-v3hh:pkg:00b0d10a50161bf371607a7b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-5jmr-gcrj-2c9q:pkg:a0018e9af34eebac2a2f84c0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-8x6r-g9mw-2r78:pkg:adfbfd3e7e6004ef5f8fccc7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-hmw2-7cc7-3qxx:pkg:b7ecfe36ec4fd3c96631003d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-wpfp-gwwc-vwq6:pkg:c7e4207cb1c35dae1718d23d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-c2c7-rcm5-vvqj:pkg:6159a1838ee53aace6ac3052 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-898c-q2cr-xwhg:pkg:943dd65dcc4518061fa06cea applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-hfxv-24rg-xrqf:pkg:b45f91a59ce63616dfd30215 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-r28c-9q8g-f849:pkg:bae8c729cd012e7cdc762310 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-8646-j5j9-6r62:pkg:8a37b9bdbafa2006f1c71fc7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-4hqw-qxg8-jxx2:pkg:da72be5eebd278f8c9f6c94c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-2598:pkg:3d9b1f8fdf4186bde9830d44 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-3w6x-2g7m-8v23:pkg:0a1c89a804db7b83dc782619 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-3041:pkg:80a9df5873ad78c9f17f9a5b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-3476:pkg:82b8aaeecb3a7e6e69826532 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-72m8-9m7m-h278:pkg:d2fc915fbce998952cc3be7f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-h67p-54hq-rp68:pkg:0199d54d4e55594b20539f39 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-xhjh-pmcv-23jw:pkg:42c412aca044999202c22f85 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-xwg4-73v4-xw9w:pkg:b0abe8c9840bfaafb5747f78 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-chx6-hx7r-mcp5:pkg:11f44f1804f868cc1cd59694 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-mf9w-mj56-hr94:pkg:dcf36134bb8329ed97c3fe0e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-c83g-rgw3-j3cx:pkg:5b4aa5061dfdb1f92efc633d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-1549:pkg:4d33784811bbdba18fcf76aa applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-2504:pkg:a5d382b8d0ebf91c3e49c2f9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:006e2a19c763cc0fc17b9679 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-1852:pkg:905f8066fdcb4968742470d2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-7q8q-rj6j-mhjq:pkg:0aa5cff2be9696730c1cc2c6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-f886-m6hf-6m8v:pkg:3c9cac5b1efe1960955c0ea1 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-3p68-rc4w-qgx5:pkg:ce67f87273bd0c79d2fefa48 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-m2v5-74w2-qhcj:pkg:e0e39f1675aab34a5130b641 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-69x8-hrgq-fjj8:pkg:10fa7f48a7a08a6427881a97 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-qhr7-859c-m2p7:pkg:7ff99bf6c6647fed08464ca3 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-pmwg-cvhr-8vh7:pkg:e41fdf6e6c2ee20e96651c5e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-53mr-6c8q-9789:pkg:9a6be17a7b2b187d3bf62a93 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-1546:pkg:213bf6dfa2b0300a77f3be7c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-pmv8-rq9r-6j72:pkg:83e3dd5872d0cb1357cb1542 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-mj87-hwqh-73pj:pkg:e43e776a0e95c997a8b56058 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-mwf2-3pr3-8698:pkg:ac59d79a9f1d9830cc88d85c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-2j2x-hqr9-3h42:pkg:2688ed9f92e03e9241c9fe2f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-jqh4-m9w3-8hp9:pkg:44fcc681efec8a16e5b4d7f2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-4072:pkg:40e8c4bf91708da67c6fde52 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-gg5m-55jj-8m5g:pkg:24bd400432bbb4aa7f51342c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-4g5m-c9r5-49xf:pkg:40b23789c3a1cdc0f0c2b292 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-p498-v437-472g:pkg:c16916843384d122918d4b2c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-j5f8-grm9-p9fc:pkg:b9510c5d99aad309e2aa5d60 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-vffw-93wf-4j4q:pkg:1050d3c9d827ed865326ac0d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory PYSEC-2026-3478:pkg:39ab51a0475eaa1ba66f5cf4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: backend/requirements.txt

  • Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:8dfa267b268efc0b662f65f3 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

Contextual expected matches (14)

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner flagged a text-matching pattern used to highlight character names that start with @ in the story text. Looking at the actual pattern, it is a simple, fixed name-matcher for the project's own mention feature, not a hidden or dangerous capability. At worst, an extremely long crafted message could briefly slow the page for the person who posted it, which is a cosmetic issue, not a security threat.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged line is a fixed literal regular expression used with String.prototype.split to highlight @-mention character names in narrative text. The pattern contains a character class with a Unicode letter range and a repeated optional group, which static regex analyzers sometimes rate as potentially unsafe because nested repetition can, in some inputs, cause quadratic backtracking. Here the pattern is anchored by a literal '@' and each repetition must consume at least one whitespace plus one uppercase letter, so the classic catastrophic-backtracking shapes (nested quantifiers over the same single-character class) are not present. The input is a single narrative message string rendered per component, and split runs once per text block. No attacker-controlled remote path, no unbounded input loop, no network egress, no persistence, and no code-execution primitive is involved. The capability matches the project's stated purpose of rendering @Name mentions in narration. Even in the worst case, a pathological message could cause a momentary UI slowdown in the user's own local session, which is a self-DoS with low impact and no demonstrated exposure.

Impact: none · Exploitability: unlikely

Developer action: None required. If desired purely as hygiene, the mention pattern could be simplified (for example, matching a bounded number of name words) or replaced with a non-backtracking scan, but there is no security defect here.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
frontend/src/components/GameCanvas.jsx:33

Gitleaks reported curl-auth-header

Expected behavior · high confidence

This is a setup guide showing how to test your own local proxy. The value in the header is a placeholder example key for a server on your own machine, not a real leaked password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule curl-auth-header. The match applies to this repository.

Contextual assessment: The match is a curl Authorization header inside a fenced bash example block in a documentation file (file_role documentation, no runtime execution). The bearer value is a placeholder local proxy key for a loopback endpoint on the user's own machine; the README explicitly states real keys live in an untracked .env and provider OAuth credentials under a user home directory. No actual credential is exposed and no shipped executable behavior is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
curl-auth-header
File role
documentation
Source
proxy/README.md:35

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The install script adds one line to your shell settings so the newly installed command can be found later — the same thing most command-line installers do. The line runs nothing by itself and nothing is hidden from the user.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line passes the user's bash startup file to a helper that appends a single line exporting a user-local bin directory onto the shell search path, used only when installing without root to a user-writable location. The helper is idempotent, the appended line performs no execution, and its sole effect is making the installed command discoverable in later shells. This is standard, visible installer behavior proportional to the script's purpose, invoked manually by the user, with no concealed trigger, obfuscation, or remote content executed at login.

Impact: none · Exploitability: unlikely

Developer action: Optionally print a notice when shell startup files are modified; no security change is required.

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
cli.sh:25

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The flagged line is a documentation example that fetches a model list from a server running on your own computer and pipes it into a JSON pretty-printer. Nothing is downloaded and run as code, and the line is instructional text, not executed software.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The download-and-execute pattern matched a curl piped to python -m json.tool inside a documentation code block. The request targets a loopback endpoint on the user's own local proxy, and the piped command only formats JSON for display; no remote or untrusted content is executed. The line is illustrative documentation with no runtime path in shipped code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
proxy/README.md:35

Gitleaks reported curl-auth-header

Expected behavior · high confidence

This is an example command in the setup guide showing how to test the local proxy. The key is an obvious stand-in value that guards a program running on the user's own computer, and the guide itself says so. No real secret was exposed.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule curl-auth-header. The match applies to this repository.

Contextual assessment: The flagged documentation lines are a multi-line sample request that passes a bearer token in an authorization header to a local proxy bound to the loopback interface. The token value is a plainly named placeholder that the same document explicitly describes as the locally configured proxy key, not a provider-issued or harvested credential. The file is documentation and executes nothing; no destination beyond the user's own machine is involved. The scanner matched the shape of an authorization header.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
curl-auth-header
File role
documentation
Source
proxy/README.md:38-39

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner flagged a tiny text-matching pattern that recognizes numbers so the app can color them in a JSON preview. The pattern is simple and linear, and all displayed text is properly escaped before being shown. This is a normal part of the scenario editor and poses no security risk.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged line is a small, fixed numeric-literal regex used inside a local JSON syntax-highlighting helper. It matches an optional minus sign, digits, an optional fractional part, and an optional exponent, and is applied to a slice of text to colorize numbers in a story-card editor preview. The pattern is entirely linear: each optional group is matched at most once, there are no nested quantifiers, and it is anchored to the start of the sliced string. It cannot exhibit exponential or quadratic backtracking. The surrounding code HTML-escapes all emitted content before building the highlight string, the input is scenario text the local author types or imports from their own file, and the function only produces display markup. There is no network destination, no persistence, no obfuscation, and no execution path beyond this rendering loop. The scanner's unsafe-regex signal is a static heuristic tied to the regex literal's character-class structure and does not reflect an actual denial-of-service or other exploitable condition. The capability is proportionate to the stated purpose of editing and previewing scenario JSON.

Impact: none · Exploitability: unlikely

Developer action: None required.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
frontend/src/components/ScenarioBuilder.jsx:124

Gitleaks reported generic-api-key

Expected behavior · high confidence

A secret-scanning tool flagged this line as possibly containing an API key, but the actual content is just a fictional label for a story card, not a real credential. Nothing sensitive was exposed.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The flagged line is a trigger-key field inside a static scenario data file defining fictional story cards for a roleplay engine. The matched line contains only a faction card name and trigger keyword string, with no credential-like value, no secret usage in code, no external network destination, and no executable behavior. The file is declarative scenario content with no data flow that could expose credentials. The scanner match is a false positive on a generic key pattern.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
scenario_clone_op/one_piece_adventures_lunar.json:3134

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

On macOS the same installer adds the same harmless search-path line to your shell settings files. It just lets you type the installed command later; it does not run anything on its own.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: Optionally print a notice when shell startup files are modified; no security change is required.

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
cli.sh:22

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged text is either the label used to read streaming story updates or a comment pointing at the app's own local server. The file only talks to the app's own backend, so there is nothing suspicious here.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged location contains either the string literal used to detect the standard data-field prefix while parsing streamed server-sent events, or the module's same-origin relative API base whose comment names the local development backend it is proxied to. Every request in the file is built from that relative base and targets the application's own backend endpoints; there is no external destination, encoded payload, or dynamically constructed remote URL. This matches the frontend's stated purpose of communicating with its own server.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.shady-link
File role
production
Source
frontend/src/api.js:208

Gitleaks reported curl-auth-header

Expected behavior · high confidence

A documentation example shows testing your own local proxy using a placeholder key. No real credential is revealed and nothing runs automatically.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule curl-auth-header. The match applies to this repository.

Contextual assessment: Another curl Authorization header match inside the same fenced bash example block of a documentation file. The bearer token is the placeholder local proxy key for a loopback endpoint, matching the documented example .env configuration. The file is documentation-only with no executable behavior, so no credential exposure or attacker-controlled path is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
curl-auth-header
File role
documentation
Source
proxy/README.md:38-39

Gitleaks reported curl-auth-header

Expected behavior · high confidence

The last documentation example also uses a placeholder key to test your own local proxy. There is no real secret and no code that runs on its own.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule curl-auth-header. The match applies to this repository.

Contextual assessment: A third instance of the same curl Authorization header pattern within the documentation verification examples, again carrying the placeholder local proxy key to a loopback endpoint. The value corresponds to the example .env settings shown in the same document, and the README notes real instances may use a different port and key via an untracked .env. No genuine credential, execution, or data flow beyond local documentation examples is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
curl-auth-header
File role
documentation
Source
proxy/README.md:45-46

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner mistook ordinary story text inside a game scenario file for a secret key. The flagged line just labels a fictional faction entry; there is no real credential anywhere in it.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The flagged line is a story-card field holding narrative content in a fan-made scenario data file; the surrounding entries are fictional weapon, faction, and race descriptions consumed as story text by the engine. Nothing in the matched region is token-shaped, issued by any provider, or referenced by executable code in the supplied evidence. The generic credential pattern matched ordinary prose, a false positive on story content.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
scenario_clone_op/one_piece_adventures_lunar.json:3134

Gitleaks reported curl-auth-header

Expected behavior · high confidence

A setup-guide example shows how to list models from the local proxy using a stand-in key that only protects a program on the user's own machine. The guide openly documents this value, so nothing secret was leaked.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule curl-auth-header. The match applies to this repository.

Contextual assessment: The flagged line is a sample model-listing command in the proxy setup guide, sending a placeholder bearer token to a loopback-only endpoint. The document states the value is the locally configured proxy key matching the user's own configuration file, so it is disclosed example configuration rather than a leaked credential. Documentation content creates no runtime data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
curl-auth-header
File role
documentation
Source
proxy/README.md:35

Gitleaks reported curl-auth-header

Expected behavior · high confidence

Another example command in the guide tests a model through the local proxy using the same obvious stand-in key. It only reaches the user's own machine and the guide explains where the value comes from, so there is no real leak.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule curl-auth-header. The match applies to this repository.

Contextual assessment: The flagged lines are another sample request in the same verification section, carrying the same documented placeholder token to the same loopback proxy endpoint. The value is not provider-issued, is disclosed by the document itself, and the file has no executable effect. The credential-exposure match is a pattern hit on an example authorization header, not evidence of a real secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
curl-auth-header
File role
documentation
Source
proxy/README.md:45-46

Related contextual observations

Installer warns and continues when artifact checksum verification is unavailable

low risk · medium confidence

The installer normally checks that the downloaded program was not tampered with. In a few situations it cannot do the check, prints a warning, and installs anyway. That is slightly risky if the download site were ever hacked, but nothing shown indicates that happened.

Technical assessment

The installer downloads an executable archive over HTTPS and compares it to a checksum file fetched from the same distribution host. When the archive has no checksum entry, or no hashing tool is installed, the script skips the comparison after printing a warning, and a failed optional signature check also continues. These fallbacks reduce integrity assurance for a downloaded executable, although all downloads come from a single fixed HTTPS host, every bypass is disclosed to the user, and no attacker-controlled input or compromise path appears in the supplied evidence.

Impact: medium · Exploitability: unlikely

Developer action: Fail the installation when the expected checksum entry is missing or no hashing tool is available, instead of warning and continuing; treat a present-but-failed signature verification as fatal.

Sources:

Documentation-only placeholder proxy key examples cause scanner matches

low risk · high confidence

All four flagged items come from the same how-to guide showing example commands for a proxy that runs on the user's own machine. They use a made-up example key, not real secrets, and the guide is not software that runs by itself.

Technical assessment

All four candidates arise from a single verification section of a documentation file consisting of fenced bash examples for a locally hosted proxy. The Authorization values are a documented placeholder key consistent with the example .env configuration, the requests target loopback endpoints, and the piped python invocation only pretty-prints JSON. The document explicitly states that real credentials reside in an untracked .env file and a user home directory, none of which are present in the repository data. No executable code, real credential, external destination, or attacker-controlled data flow is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Inventory
329 files · 5731831 bytes
Contextual coverage
180 of 180 candidates assessed

JavaScript coverage

Status
Complete
Candidates
25 files · 198609 bytes
X-Ray review families
5 warning occurrences compacted to 4 evidence-preserving review families
Representations
25 raw · 1 decoded · 0 normalized · 0 bundle modules
Stage scans
25 raw signatures · 25 raw AST · 25 raw OpenGrep · 1 derived signatures · 0 derived AST · 1 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
20a284eb91d9f3da5d670cc08b61c7ec11bff067
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
8 fresh / 0 reused groups · 14 fresh / 0 reused candidates
Review source reports
none
Evidence triage
166 deterministic / 14 contextual candidates · 8 contextual / 32 total behavior cases
Model budget
4 model calls · 8 / 12 fresh cases · 138952 / 200000 estimated input · 104852 / 250000 actual input · 13146 / 40000 output tokens
Review batching
4 model calls · up to 4 groups and 7 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
104852 input · 13146 output · 0 cache read · 7406 reasoning tokens
Report
eafd79ecf304bd960af690aee3b1852c5415fafce71ade394b651e27231d02ab