The scanner flagged a CSS style rule as persistence behavior, but it is just visual styling for the profile page layout. No security issue.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.
Contextual assessment: Line 492 is a CSS class selector (.profile-sidebar) inside a scoped style block. It sets padding, background, border, and flexbox layout properties. There is no JavaScript execution, no persistence mechanism, no startup modification, and no data flow. The scanner's persistence.startup-modification rule is a false positive on CSS declarations.
Credential access and network transmission in one file
Expected behavior · high confidence
The app sends your login token only to its own backend API to prove who you are when loading or posting game data. This is how authenticated web apps normally work. The token is not sent to any external or suspicious destination.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The scanner flagged the co-location of a credential source (authState.token read in authHeaders at line 166) and a network sink (fetch at line 173). However, the actual data flow shows the token is placed into a standard 'Authorization: Bearer' header and sent only to relative '/api' endpoints (BASE = '/api'), which resolve to the same origin as the frontend. All fetch calls target the project's own backend adventure/chat endpoints. There is no exfiltration to third-party or external domains, no obfuscation, and no concealed transmission. This is standard authentication behavior for a single-page application communicating with its own backend.
The flagged line is a CSS styling rule for the profile container. It has nothing to do with persistence or security.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.
Contextual assessment: Line 450 is a CSS class selector (.profile-container) in a scoped style block defining padding, height, overflow, and width. No executable code, no persistence, no startup behavior. False positive from the scanner on CSS.
This is a normal setup script that, after asking the user for confirmation, starts the project's own backend and frontend in the background. The relative paths point to the project's own virtual environment and frontend folder, which is standard for a local development setup.
Technical evidence
Scanner reason: malcontent matched behavioral-analysis rule exec-shell-background_launcher. The match applies to this repository.
Contextual assessment: The file script creates a Python virtual environment under ./venv, installs dependencies, generates local encryption and secret keys, runs database migrations, installs frontend npm dependencies, and optionally launches the project's own backend (./venv/bin/python3 -m backend.main) and frontend (npm run dev) as background processes. The scanner flagged background process launches from relative paths, but these paths reference the project's own venv directory and frontend folder created earlier in the same script. The launch is gated behind an interactive user prompt (read -p) and a --skip-start flag. There is no attacker-controlled input, no external destination, no obfuscation, and no credential exfiltration. This is standard development setup behavior proportionate to the stated project purpose.
The flagged line is a documentation example that pipes a local API response through a JSON formatter. It does not download or execute anything from the internet.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: Line 155 contains a curl command targeting localhost (127.0.0.1:7860) piped to python -m json.tool, which only pretty-prints JSON. This is documentation showing users how to verify their local Stable Diffusion daemon. No remote download-and-execute occurs; the pipe is to a standard JSON formatter, not arbitrary code execution. The file role is documentation with no runtime behavior.
The flagged line is a CSS grid layout rule for the profile dashboard. It is purely visual styling with no security relevance.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.
Contextual assessment: Line 470 is a CSS class selector (.profile-dashboard) in a scoped style block defining a CSS grid layout. No JavaScript, no persistence mechanism, no startup modification. Scanner false positive on CSS.
The flagged code reads a standard environment variable to decide linting strictness. It is a normal build-time configuration pattern with no security impact.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: Line 17 reads process.env.NODE_ENV in an ESLint configuration file to conditionally set the no-console rule severity. This is a standard Vue/TypeScript project linting pattern executed at build time, not runtime. The environment variable access is limited to NODE_ENV, a non-sensitive build flag. No credentials, secrets, or sensitive environment data are serialized or transmitted. The scanner's serialize-environment signal is a false positive on this idiomatic config pattern.
The flagged line is a CSS styling rule for the profile card appearance. It is purely cosmetic with no security impact.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.
Contextual assessment: Line 457 is a CSS class selector (.profile-card) in a scoped style block defining width, max-width, margin, background gradient, border, border-radius, and box-shadow. No executable code, no persistence, no startup behavior. Scanner false positive on CSS declarations.
The flagged line is a CSS layout rule for the main content panel. It is purely visual styling with no security relevance.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.
Contextual assessment: Line 662 is a CSS class selector (.profile-main) inside a scoped style block in a Vue single-file component. It defines padding, display flex, flex-direction, and gap properties. No JavaScript, no persistence mechanism, no startup modification, and no data flow. The scanner's persistence.startup-modification rule is a false positive on CSS declarations.
The command simply formats JSON output from a local service for readability.
Technical assessment
The curl-to-python pipe at line 155 sends a GET request to the local loopback SD WebUI API and pipes the response through python -m json.tool for pretty-printing. No remote content is downloaded or executed; python -m json.tool is a read-only JSON formatter. This is standard documentation for verifying a local daemon.
Reading NODE_ENV in an ESLint config is a common practice for adjusting lint rules between development and production builds.
Technical assessment
The process.env.NODE_ENV reference at line 17 is a standard ESLint configuration idiom that toggles console and debugger warnings based on build mode. It accesses only NODE_ENV, a non-sensitive variable, and runs during linting, not in the shipped application runtime.
CSS selectors falsely flagged as persistence mechanisms
low risk · high confidence
Multiple CSS style rules were incorrectly flagged as persistence mechanisms. They are just visual layout and styling definitions with no executable behavior.
Technical assessment
All four candidates (lines 450, 457, 470, 492) are CSS class selectors in a scoped style block within a Vue single-file component. They define layout and visual properties (padding, grid, borders, shadows). No JavaScript execution, persistence mechanisms, or startup modification is present. The scanner's persistence.startup-modification rule matched on CSS property names, producing false positives.
CSS selector falsely flagged as persistence mechanism
low risk · high confidence
The flagged CSS rule styles the main content area of the user profile page. No executable code or persistence behavior is present.
Technical assessment
The .profile-main CSS selector at line 662 sets padding, display, flex-direction, and gap in a scoped style block. No executable code, persistence, or startup behavior is involved. Scanner false positive on CSS.