TavernKeeper Scan Report

jschm42/taleweaver

Commit 3f9be7f Reviewed Sep 2, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 21 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (8)

zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:24
Dependency advisory GHSA-rgw5-rvv9-x895:pkg:e2d26d120652434b1043ffdf applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:21
Dependency advisory GHSA-73wf-gq98-2v4g:pkg:978489779fc1a775f3f91fab applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895:pkg:b8b4e108ab4269d091ad76f5 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json
Dependency advisory GHSA-w9m9-85wc-3x92:pkg:789fe9d4eb26f7c51d684509 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:20-21
Dependency advisory GHSA-c83g-rgw3-j3cx:pkg:55c4a668cc988d5ceedbfbf6 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json

Contextual expected matches (9)

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The scanner flagged a CSS style rule as persistence behavior, but it is just visual styling for the profile page layout. No security issue.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: Line 492 is a CSS class selector (.profile-sidebar) inside a scoped style block. It sets padding, background, border, and flexbox layout properties. There is no JavaScript execution, no persistence mechanism, no startup modification, and no data flow. The scanner's persistence.startup-modification rule is a false positive on CSS declarations.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:492

Credential access and network transmission in one file

Expected behavior · high confidence

The scanner flagged that the app's login token and network requests appear together in one file. Looking at what the code actually does, the token is only used to prove who you are when the game loads your session or sends your messages to the app's own server. Nothing goes to any outside service, and no data is being siphoned off. This is exactly what a logged-in game is supposed to do.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The candidate is a co-location heuristic: a helper that reads the stored session token and a network sink exist in the same module. Tracing the actual data flow, the token is only attached as a bearer credential in requests to the application's relative, same-origin API base for session snapshot loading, chat message posting, and agent turns. No absolute or third-party destination appears in the supplied code, and the token is never logged, persisted outside the auth store, or embedded in message payloads. This is the standard authentication pattern for an authenticated browser frontend talking to its own backend, fully proportionate to the project's stated purpose of an AI roleplaying client. No attacker-controlled trigger, untrusted-input path, or credential diversion is demonstrated.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: frontend/src/composables/useGameSocket.ts:173

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is a CSS styling rule for the profile container. It has nothing to do with persistence or security.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: Line 450 is a CSS class selector (.profile-container) in a scoped style block defining padding, height, overflow, and width. No executable code, no persistence, no startup behavior. False positive from the scanner on CSS.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:450

malcontent reported exec-shell-background_launcher

Expected behavior · high confidence

This is a normal setup script that, after asking the user for confirmation, starts the project's own backend and frontend in the background. The relative paths point to the project's own virtual environment and frontend folder, which is standard for a local development setup.

Technical evidence

Scanner reason: malcontent matched behavioral-analysis rule exec-shell-background_launcher. The match applies to this repository.

Contextual assessment: The file script creates a Python virtual environment under ./venv, installs dependencies, generates local encryption and secret keys, runs database migrations, installs frontend npm dependencies, and optionally launches the project's own backend (./venv/bin/python3 -m backend.main) and frontend (npm run dev) as background processes. The scanner flagged background process launches from relative paths, but these paths reference the project's own venv directory and frontend folder created earlier in the same script. The launch is gated behind an interactive user prompt (read -p) and a --skip-start flag. There is no attacker-controlled input, no external destination, no obfuscation, and no credential exfiltration. This is standard development setup behavior proportionate to the stated project purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: malcontent 1.25.7
Rule: exec-shell-background_launcher
File role: production
Source: setup.sh

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The flagged line is a documentation example that pipes a local API response through a JSON formatter. It does not download or execute anything from the internet.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: Line 155 contains a curl command targeting localhost (127.0.0.1:7860) piped to python -m json.tool, which only pretty-prints JSON. This is documentation showing users how to verify their local Stable Diffusion daemon. No remote download-and-execute occurs; the pipe is to a standard JSON formatter, not arbitrary code execution. The file role is documentation with no runtime behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.download-and-execute.shell-pipeline
File role: documentation
Source: docs/HOWTO_LOCAL_STABLE_DIFFUSION.md:155

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is a CSS grid layout rule for the profile dashboard. It is purely visual styling with no security relevance.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: Line 470 is a CSS class selector (.profile-dashboard) in a scoped style block defining a CSS grid layout. No JavaScript, no persistence mechanism, no startup modification. Scanner false positive on CSS.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:470

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The flagged code reads a standard environment variable to decide linting strictness. It is a normal build-time configuration pattern with no security impact.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: Line 17 reads process.env.NODE_ENV in an ESLint configuration file to conditionally set the no-console rule severity. This is a standard Vue/TypeScript project linting pattern executed at build time, not runtime. The environment variable access is limited to NODE_ENV, a non-sensitive build flag. No credentials, secrets, or sensitive environment data are serialized or transmitted. The scanner's serialize-environment signal is a false positive on this idiomatic config pattern.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: production
Source: frontend/.eslintrc.cjs:17

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is a CSS styling rule for the profile card appearance. It is purely cosmetic with no security impact.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: Line 457 is a CSS class selector (.profile-card) in a scoped style block defining width, max-width, margin, background gradient, border, border-radius, and box-shadow. No executable code, no persistence, no startup behavior. Scanner false positive on CSS declarations.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:457

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is a CSS layout rule for the main content panel. It is purely visual styling with no security relevance.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: Line 662 is a CSS class selector (.profile-main) inside a scoped style block in a Vue single-file component. It defines padding, display flex, flex-direction, and gap properties. No JavaScript, no persistence mechanism, no startup modification, and no data flow. The scanner's persistence.startup-modification rule is a false positive on CSS declarations.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:662

Related contextual observations

Local curl piped to json.tool in documentation

low risk · high confidence

The command simply formats JSON output from a local service for readability.

Technical assessment

The curl-to-python pipe at line 155 sends a GET request to the local loopback SD WebUI API and pipes the response through python -m json.tool for pretty-printing. No remote content is downloaded or executed; python -m json.tool is a read-only JSON formatter. This is standard documentation for verifying a local daemon.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

docs/HOWTO_LOCAL_STABLE_DIFFUSION.md:155

Standard NODE_ENV check in ESLint config

low risk · high confidence

Reading NODE_ENV in an ESLint config is a common practice for adjusting lint rules between development and production builds.

Technical assessment

The process.env.NODE_ENV reference at line 17 is a standard ESLint configuration idiom that toggles console and debugger warnings based on build mode. It accesses only NODE_ENV, a non-sensitive variable, and runs during linting, not in the shipped application runtime.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

frontend/.eslintrc.cjs:17

CSS selectors falsely flagged as persistence mechanisms

low risk · high confidence

Multiple CSS style rules were incorrectly flagged as persistence mechanisms. They are just visual layout and styling definitions with no executable behavior.

Technical assessment

All four candidates (lines 450, 457, 470, 492) are CSS class selectors in a scoped style block within a Vue single-file component. They define layout and visual properties (padding, grid, borders, shadows). No JavaScript execution, persistence mechanisms, or startup modification is present. The scanner's persistence.startup-modification rule matched on CSS property names, producing false positives.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

CSS selector falsely flagged as persistence mechanism

low risk · high confidence

The flagged CSS rule styles the main content area of the user profile page. No executable code or persistence behavior is present.

Technical assessment

The .profile-main CSS selector at line 662 sets padding, display, flex-direction, and gap in a scoped style block. No executable code, persistence, or startup behavior is involved. Scanner false positive on CSS.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

frontend/src/components/portal/UserProfileContent.vue:662

Coverage and limitations

Inventory: 526 files · 70211165 bytes
Contextual coverage: 17 of 17 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 42 files · 266421 bytes
X-Ray review families: 2 warning occurrences compacted to 1 evidence-preserving review families
Representations: 42 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans: 42 raw signatures · 7 raw AST · 42 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Unresolved JavaScript stages

frontend/src/composables/useApi.ts — raw-ast / parse
frontend/src/composables/useGameAutoSpeak.ts — raw-ast / parse
frontend/src/composables/useGameCommandFlow.ts — raw-ast / parse
frontend/src/composables/useGameInteractionState.ts — raw-ast / parse
frontend/src/composables/useGameProgressState.ts — raw-ast / parse
frontend/src/composables/useGameSessionLifecycle.ts — raw-ast / parse
frontend/src/composables/useGameSocket.ts — raw-ast / parse
frontend/src/composables/useGameUiFeedback.ts — raw-ast / parse
frontend/src/composables/useNotifications.ts — raw-ast / parse
frontend/src/composables/usePortalData.ts — raw-ast / parse
frontend/src/composables/usePortalModals.ts — raw-ast / parse
frontend/src/composables/usePortalPendingState.ts — raw-ast / parse
frontend/src/composables/usePortalSectionRouting.ts — raw-ast / parse
frontend/src/constants/createAdventureHelpTexts.ts — raw-ast / parse
frontend/src/env.d.ts — raw-ast / parse
frontend/src/services/adventureService.ts — raw-ast / parse
frontend/src/services/audioService.ts — raw-ast / parse
frontend/src/services/catalogService.ts — raw-ast / parse
frontend/src/services/entityService.ts — raw-ast / parse
frontend/src/services/gameActionService.ts — raw-ast / parse
frontend/src/services/gameCommandService.ts — raw-ast / parse
frontend/src/services/gameViewService.ts — raw-ast / parse
frontend/src/services/hoverEntityService.ts — raw-ast / parse
frontend/src/services/http.ts — raw-ast / parse
frontend/src/services/notificationService.ts — raw-ast / parse
frontend/src/services/settingsService.ts — raw-ast / parse
frontend/src/services/testService.ts — raw-ast / parse
frontend/src/services/userService.ts — raw-ast / parse
frontend/src/services/visualService.ts — raw-ast / parse
frontend/src/store/auth.ts — raw-ast / parse
frontend/src/store/config.ts — raw-ast / parse
frontend/src/types/index.ts — raw-ast / parse
frontend/src/utils/commands.ts — raw-ast / parse
frontend/src/utils/editor_utils.ts — raw-ast / parse
frontend/src/utils/game_icons.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 3f9be7f452648461cf04b86e94c17c2bbcfcde50
Completed: Sep 2, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 1 fresh / 5 reused groups · 1 fresh / 8 reused candidates
Review source reports: 2e28d68208e3bb84c64d3901a4d078c60715acc24730916a4d192dd5f55ce15b
Evidence triage: 8 deterministic / 9 contextual candidates · 6 contextual / 8 total behavior cases
Model budget: 1 model call · 1 / 12 fresh cases · 21471 / 200000 estimated input · 16039 / 250000 actual input · 1344 / 40000 output tokens
Review batching: 1 model call · up to 1 groups and 1 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 16039 input · 1344 output · 1344 cache read · 830 reasoning tokens
Report: ce40d0d814b897e28c5834c7b470bc96d5aca6779dcf590f07949fb69f77fb80