TavernKeeper Scan Report

jschm42/taleweaver

Commit 942c22a Reviewed Oct 20, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 17 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (10)

zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:24
Dependency advisory GHSA-494j-54xm-rwp3:pkg:2468c647aaa528a7a61ad414 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: poetry.lock
Dependency advisory GHSA-vfj7-8cjw-p6xm:pkg:efd3ff768f6f1133cf11c41f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:21
Dependency advisory GHSA-5wr8-gcqf-gqf3:pkg:dea14742662964bb538ce486 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: poetry.lock
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:20-21
Dependency advisory GHSA-68fv-2mgg-jv7q:pkg:9534329f616dc744f00f37e0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json
Dependency advisory GHSA-rj75-hqrm-r3gf:pkg:78aa5c5da8976703de35744b applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json
Dependency advisory GHSA-2g87-pp6c-29x5:pkg:70b29a7b693f1d6627edc154 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: poetry.lock
Dependency advisory GHSA-g2v6-rqmx-r4w6:pkg:86e27635ae63081d7f2a518d applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: frontend/package-lock.json

Contextual expected matches (7)

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

These are styling rules that make popup notifications fade in and out on the user profile page. They do not install, save, or change anything when the app starts.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is part of a scoped CSS block defining toast notification animation classes for the profile page. It contains only transition and opacity styling; there is no startup hook, registration mechanism, persistent storage write, or any code executed at application launch. The scanner rule appears to have pattern-matched CSS selector names without any persistence behavior present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:136

Credential access and network transmission in one file

Expected behavior · high confidence

When you sign in, the app keeps a login token and includes it when asking its own server for your saved game data. That is how login systems normally work; the token is only sent back to the same server that gave it out, not to anyone else.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The file contains a session authentication helper that attaches the logged-in user's own bearer token to requests sent to a relative same-origin API path under the application's own backend, and a fetch call to that backend to load the player's game session snapshot. This is the standard, expected pattern for an authenticated SPA talking to its own server: the token originates from the app's auth state, is disclosed only to the origin that issued it, and no third-party or hardcoded external destination appears anywhere in the supplied source. The scanner flagged credential handling and a network call co-located in one file, but the actual data flow shows the token going only to the issuing backend, which is proportionate to the project's stated purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: frontend/src/composables/useGameSocket.ts:216

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line only styles how a popup disappears. It cannot run anything or save anything on the user's system.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS selector for the toast notification exit animation in a scoped style block. It is purely declarative UI styling with no script, lifecycle hook, or persistence mechanism. The scanner matched CSS text without corresponding executable behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:135

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line sets how fast a notification animates. It is pure visual styling with no programmatic effect.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS transition property inside the profile page's scoped toast animation styles. It contains no JavaScript, no startup execution, and no write to any persistent store. The persistence classification is a keyword-level false positive on stylesheet content.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:132

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The guide suggests a harmless troubleshooting command that fetches a list of installed AI models from the user's own computer and formats it for reading. Nothing downloaded is run as a program, and this text is only instructions for a person, not part of the application itself.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The flagged line is documentation text inside a Markdown setup guide, not executable project code. The command pipes a loopback HTTP response from the user's own local Stable Diffusion daemon into a JSON pretty-printing utility module, which only parses and formats JSON; it does not evaluate the downloaded content as code. There is no remote download executed at app runtime, no obfuscation, and the destination is the user's own localhost service. The scanner rule matched the superficial curl-pipe pattern without accounting for the parser sink or the documentation context.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.download-and-execute.shell-pipeline
File role: documentation
Source: docs/HOWTO_LOCAL_STABLE_DIFFUSION.md:155

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This is another piece of the popup animation styling. None of the flagged lines in this file do anything beyond controlling visual appearance.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS class selector grouping toast enter and leave animation rules in a scoped style block. No code executes at startup, no state is persisted, and no network or storage access exists in this styling content. All four flagged candidates in this group are the same false positive pattern applied to adjacent stylesheet lines.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: frontend/src/components/portal/UserProfileContent.vue:131

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

This is a routine config file that checks whether the project is being built for release so it can warn developers about leftover debug statements. It does not read or send any secrets or user information anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The flagged lines are an ESLint configuration that reads a single well-known environment variable (the build mode) to decide whether console and debugger statements produce lint warnings. This is the standard boilerplate generated by Vue project scaffolding. The variable value is used only as a boolean comparison inside the lint tool; it is not serialized, transmitted, logged, or otherwise disclosed to any network destination, and the file is a development tooling configuration rather than shipped application code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: production
Source: frontend/.eslintrc.cjs:17

Coverage and limitations

Inventory: 785 files · 74533331 bytes
Contextual coverage: 17 of 17 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 61 files · 399301 bytes
X-Ray review families: 2 warning occurrences compacted to 1 evidence-preserving review families
Representations: 61 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans: 61 raw signatures · 6 raw AST · 61 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Unresolved JavaScript stages

frontend/src/components/game/combat/arena/ArenaRenderer.ts — raw-ast / parse
frontend/src/components/game/combat/arena/CombatantCard.ts — raw-ast / parse
frontend/src/components/game/combat/arena/DiceRoller.ts — raw-ast / parse
frontend/src/components/game/combat/arena/effects.ts — raw-ast / parse
frontend/src/components/game/combat/arena/eventPlayer.ts — raw-ast / parse
frontend/src/components/game/combat/arena/palette.ts — raw-ast / parse
frontend/src/components/game/combat/arena/tween.ts — raw-ast / parse
frontend/src/components/portal/profile/sessionStatus.ts — raw-ast / parse
frontend/src/composables/comicPages.ts — raw-ast / parse
frontend/src/composables/useApi.ts — raw-ast / parse
frontend/src/composables/useComicTurns.ts — raw-ast / parse
frontend/src/composables/useEntityTransfer.ts — raw-ast / parse
frontend/src/composables/useGameAutoSpeak.ts — raw-ast / parse
frontend/src/composables/useGameCommandFlow.ts — raw-ast / parse
frontend/src/composables/useGameInteractionState.ts — raw-ast / parse
frontend/src/composables/useGameProgressState.ts — raw-ast / parse
frontend/src/composables/useGameSessionLifecycle.ts — raw-ast / parse
frontend/src/composables/useGameSocket.ts — raw-ast / parse
frontend/src/composables/useGameUiFeedback.ts — raw-ast / parse
frontend/src/composables/useNotifications.ts — raw-ast / parse
frontend/src/composables/usePasswordPolicy.ts — raw-ast / parse
frontend/src/composables/usePortalData.ts — raw-ast / parse
frontend/src/composables/usePortalFilters.ts — raw-ast / parse
frontend/src/composables/usePortalModals.ts — raw-ast / parse
frontend/src/composables/usePortalPendingState.ts — raw-ast / parse
frontend/src/composables/usePortalSectionRouting.ts — raw-ast / parse
frontend/src/composables/useStoryBubbleAudio.ts — raw-ast / parse
frontend/src/composables/useVoiceInput.ts — raw-ast / parse
frontend/src/constants/createAdventureHelpTexts.ts — raw-ast / parse
frontend/src/env.d.ts — raw-ast / parse
frontend/src/router/index.ts — raw-ast / parse
frontend/src/services/adventureService.ts — raw-ast / parse
frontend/src/services/audioService.ts — raw-ast / parse
frontend/src/services/catalogService.ts — raw-ast / parse
frontend/src/services/entityService.ts — raw-ast / parse
frontend/src/services/gameActionService.ts — raw-ast / parse
frontend/src/services/gameCommandService.ts — raw-ast / parse
frontend/src/services/gameViewService.ts — raw-ast / parse
frontend/src/services/hoverEntityService.ts — raw-ast / parse
frontend/src/services/http.ts — raw-ast / parse
frontend/src/services/notificationService.ts — raw-ast / parse
frontend/src/services/settingsService.ts — raw-ast / parse
frontend/src/services/specialAttackService.ts — raw-ast / parse
frontend/src/services/testService.ts — raw-ast / parse
frontend/src/services/ttsText.ts — raw-ast / parse
frontend/src/services/userService.ts — raw-ast / parse
frontend/src/services/visualService.ts — raw-ast / parse
frontend/src/store/auth.ts — raw-ast / parse
frontend/src/store/config.ts — raw-ast / parse
frontend/src/types/index.ts — raw-ast / parse
frontend/src/utils/cdnScriptLoader.ts — raw-ast / parse
frontend/src/utils/commands.ts — raw-ast / parse
frontend/src/utils/editor_utils.ts — raw-ast / parse
frontend/src/utils/game_icons.ts — raw-ast / parse
frontend/src/utils/specialAttacks.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 942c22a9cc3a08bc0d4a94431a21eda94427c3a2
Completed: Oct 20, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 4 fresh / 0 reused groups · 7 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 10 deterministic / 7 contextual candidates · 4 contextual / 7 total behavior cases
Model budget: 1 model call · 4 / 12 fresh cases · 55334 / 200000 estimated input · 42823 / 250000 actual input · 2436 / 40000 output tokens
Review batching: 1 model call · up to 4 groups and 7 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 42823 input · 2436 output · 0 cache read · 361 reasoning tokens
Report: 964d565685c52922a839995d3008dc0e83b5ca5fff08185235a18a84276d0ba3