TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

mekineer-com/OpenAlma

Commit 909f423 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 27 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (26)

  • Dependency advisory PYSEC-2026-1473:pkg:7aa5d849032f813d4e5396e6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-v9pg-7xvm-68hf:pkg:f9806f0dcc79a81601eccc23 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-q2x7-8rv6-6q7h:pkg:6b54606ec8875ea97d5b7191 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-6jv3-5f52-599m:pkg:f080cc8c69401251820e2e10 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1472:pkg:42301ab3fa058c530430ad86 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-h75v-3vvj-5mfj:pkg:0a5bf2ae4c836ff28bcfc665 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1475:pkg:93ea0bc6e50686a975bb661f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-h5c8-rqwp-cp95:pkg:9afe0ac551636b9c255ad355 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1852:pkg:905f8066fdcb4968742470d2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-gmj6-6f8f-6699:pkg:00b51d642d77794a04ec3bd7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-mj87-hwqh-73pj:pkg:e43e776a0e95c997a8b56058 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1474:pkg:915ea6350131371689b73dfa applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-5rvq-cxj2-64vf:pkg:86773285863dfc77c95412e5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-cpwx-vrp4-4pq7:pkg:91202ebb37aed05e7cf322d0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-vffw-93wf-4j4q:pkg:1050d3c9d827ed865326ac0d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1471:pkg:dc6caa1f386a8cb98930da9a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-pp6c-gr5w-3c5g:pkg:a5b9ad4a61e6d59c054ec7b5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-wp53-j4wj-2cfg:pkg:2186f7443db0c80e8275be19 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3037:pkg:74b9228c64f62bb86c4528ab applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3036:pkg:a49d089bcf8003a0ddf40bb9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-1851:pkg:4931fe8c489a671e86516895 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3039:pkg:14680a7b42525bf94071e12c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3038:pkg:8c302df415f37b7a8bdce01b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3040:pkg:02e6df712480e1ce9652cf54 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory GHSA-59g5-xgcq-4qw3:pkg:a1ec7327f2d984608322efc5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

  • Dependency advisory PYSEC-2026-3041:pkg:80a9df5873ad78c9f17f9a5b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: test-documentation-data

    Source: launcher/requirements.txt

Contextual expected matches (1)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

This code submits a form to the app's own server and shows the result. It never downloads anything and runs it, so the warning about 'download then execute' does not apply here.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The flagged region contains one network primitive: a fetch that POSTs the surrounding form's FormData to the form's own action URL, which for this launcher page is the application's own backend. The response is parsed as JSON for an error message and otherwise triggers ordinary browser navigation to the response URL. There is no dynamic code evaluation, no script injection of retrieved content, no exec or command sink, and no third-party or attacker-controlled destination. The scanner's correlation of a network retrieval with a code-execution sink is a false positive: the only post-response action is navigation and UI alerts, not execution of downloaded code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
launcher/static/soul-selector.js:4-37

Coverage and limitations

Inventory
46 files · 525973 bytes
Contextual coverage
27 of 27 candidates assessed

JavaScript coverage

Status
Complete
Candidates
3 files · 28237 bytes
X-Ray review families
0 warning occurrences compacted to 0 evidence-preserving review families
Representations
3 raw · 1 decoded · 1 normalized · 0 bundle modules
Stage scans
3 raw signatures · 3 raw AST · 3 raw OpenGrep · 2 derived signatures · 1 derived AST · 2 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
909f423f298c309fa1a3a6aa0d4a0a90ba4d7cc3
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
1 fresh / 0 reused groups · 1 fresh / 0 reused candidates
Review source reports
none
Evidence triage
26 deterministic / 1 contextual candidates · 1 contextual / 5 total behavior cases
Model budget
1 model call · 1 / 12 fresh cases · 9869 / 200000 estimated input · 6092 / 250000 actual input · 467 / 40000 output tokens
Review batching
1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage
6092 input · 467 output · 0 cache read · 91 reasoning tokens
Report
5bcaa00d9cdcf1f405ef7b56981e2805a002688274c977030463bac2390505b9