TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

jschm42/taleweaver

Commit de741a1 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 65 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (57)

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:24

  • Dependency advisory PYSEC-2026-3546:pkg:1bc96bdddbbff21ac418748b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2106:pkg:736242df4ac18ef85180b6f7 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-4066:pkg:449780c3fc55bccdc1c61caa applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2598:pkg:ceef7426e81de2d0a15344a6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-4070:pkg:7e7100c9a412d0f6dddbeb67 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-vfj7-8cjw-p6xm:pkg:efd3ff768f6f1133cf11c41f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-hx8v-g79f-8w5f:pkg:611b0cac03476ca8d9be733d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • zizmor reported unpinned-uses · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:21

  • Dependency advisory GHSA-g3cq-j2xw-wf74:pkg:95e22b0a5a3878a05852385a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-237:pkg:4ff78714f2b2a85a1673908f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-3476:pkg:06966d2725327ca4b75394eb applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-63hw-fmq6-xxg2:pkg:8044be2bc3916a5738f51546 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-9x8q-7h8h-wcw9:pkg:4466de15784613b608784e19 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-6688-9rhm-gjv2:pkg:0e92d3862b26a991a884938c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-4067:pkg:b77e9035c697ba9fb9142e21 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-qrc4-49gv-mv9m:pkg:da15ab9a102db79267d04fac applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-mq44-7p77-q5h7:pkg:8d4f27589d8ae5670d7dba96 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-m6qw-4cw2-hm4m:pkg:facf4170fcb5b81c8a74908a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2107:pkg:60c73d7d2bfd71c47b0afb5a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-3545:pkg:c8d4bff3ff92cdf033e5289a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2600:pkg:87027a4a3f3fab62509acb41 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-3479:pkg:61c68c7919e02687963bb007 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:20-21

  • Dependency advisory GHSA-4jcj-7x88-m979:pkg:9bf971adab6b43b107dad8a2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-3cv6-jpf6-8222:pkg:6d136d9a6def34b127afb063 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-2fqr-mr3j-6wp8:pkg:cdd1c668289ba3ece3b765e2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-68fv-2mgg-jv7q:pkg:9534329f616dc744f00f37e0 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-2110:pkg:41da6412b07705346d7eea6c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2104:pkg:a01b3d582d6e6062779da86b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2108:pkg:91d49a41716eef4f738685e5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-rj75-hqrm-r3gf:pkg:78aa5c5da8976703de35744b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory PYSEC-2026-2112:pkg:28e5afbcbc413f96d736d959 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2601:pkg:2e79a284f5757270720ba290 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2109:pkg:846edfc9b99377502025186f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2105:pkg:fddbb7f972ebe280f33de23b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-4g5m-c9r5-49xf:pkg:631acce7ceba724ff28f0c25 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-388:pkg:e4f41a09fcba10a836713f85 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-wxxx-gvqv-xp7p:pkg:c813da0f3a2d11584eb7cbd4 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-4m7w-qmgq-4wj5:pkg:47e2703add802c700f9c6fd8 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-wpfp-gwwc-vwq6:pkg:80adc922512b39b78d486a3b applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-g2v6-rqmx-r4w6:pkg:86e27635ae63081d7f2a518d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-p98j-92pf-mc4p:pkg:216b03ca9a7d2e7ff12f78f2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: frontend/package-lock.json

  • Dependency advisory GHSA-hpj7-wq8m-9hgp:pkg:b4ab583588e5a3649474ba31 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-jg22-mg44-37j8:pkg:abb00ca2c51eb75ab7c8ca4c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-mfx4-hv73-q22v:pkg:bdc8ac498d70f4d2712efbf9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2113:pkg:c07baccbd5237d6e857f4a12 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-3547:pkg:c27187677a086102b51d0948 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-4fvr-rgm6-gqmc:pkg:44923be5ecdc7a0319ee8e73 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2111:pkg:e47a3c757f78f89ba374b992 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-xcgm-r5h9-7989:pkg:591d8eea198b02b124a050f6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-hg6j-4rv6-33pg:pkg:f94ebc65a23339dce25c9bd6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-7488-6r32-c95q:pkg:2ea2cb3e67f935a263ce8549 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-mf9w-mj56-hr94:pkg:dcf36134bb8329ed97c3fe0e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory PYSEC-2026-2270:pkg:88ff04df9ed742352e55b924 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-cq5v-8q36-5273:pkg:4918df759a428790c46586f9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

  • Dependency advisory GHSA-4xpc-pv4p-pm3w:pkg:4cba9985d4470b672f24238d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: poetry.lock

Contextual expected matches (8)

Credential access and network transmission in one file

Expected behavior · high confidence

The scanner noticed that a login token and an internet request appear in the same file, which can sometimes signal theft. Reading the actual code, the token is only attached to calls the game makes to its own server to load or send your saved adventure chat, like showing your ticket at the venue that issued it. Nothing is sent anywhere else, so this is normal, expected behavior rather than a problem.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: The scanner flagged co-location of a credential source and a network sink, but the actual data flow is benign. The composable reads the application's own session token from its auth store and attaches it as a bearer authorization header on fetch calls to a fixed relative, same-origin API base path used for loading and posting adventure chat state. Every observed request stays within the application's own backend, which is the standard authenticated single-page-application pattern for a project of this stated purpose (a browser game with a backend GM service). There is no third-party or external destination, no dynamic or attacker-influenced URL, no obfuscation, and no transmission of any model-provider or unrelated credential. The scan result is a keyword-level capability heuristic, not demonstrated exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
tavernkeeper 5
Rule
credential-exfiltration
File role
production
Source
frontend/src/composables/useGameSocket.ts:200

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is ordinary page styling code that controls the spacing and scrolling of the user profile page. It does not touch any files, settings, or startup behavior on your computer.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is the opening selector of a scoped CSS rule in the component's style block that sets padding, scroll behavior, and width for the profile page container. It performs no file, registry, startup, or configuration modification of any kind; it is purely visual styling. The scanner match is a keyword-level false positive on stylesheet syntax, with no executable data flow, destination, or persistence behavior behind it.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
frontend/src/components/portal/UserProfileContent.vue:492

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is just styling code for the profile card's size, background, and shadow. It cannot change files, settings, or any startup behavior.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a scoped CSS selector for the profile card, defining its size, background gradient, border radius, and shadow. It is declarative styling with no execution, data flow, or persistence capability. The scanner match is a false positive on stylesheet syntax.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
frontend/src/components/portal/UserProfileContent.vue:450

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The documentation shows a harmless example command that asks your own locally running image-generation program for a list of installed models and formats the answer for easier reading. Nothing is downloaded from the internet, nothing runs automatically, and the response is only displayed, never executed.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.

Contextual assessment: The flagged line is a documentation snippet inside a Markdown setup guide, not shipped executable code. It instructs the user to fetch a JSON model list from a loopback address on their own machine and pipe it into a JSON pretty-printing module. The piped content is parsed as data and printed, not executed as code, the source is the user's own local daemon, and the command is run manually by the user only during optional setup verification. There is no hidden download, no remote attacker-controlled source, and no execution of fetched content.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
docs/HOWTO_LOCAL_STABLE_DIFFUSION.md:155

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is layout styling that arranges the profile dashboard on screen, including how it adapts to wider displays. It has no ability to modify files, settings, or startup behavior.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a scoped CSS selector that defines a responsive grid layout for the profile dashboard, including column configuration under a media query. It is declarative presentation styling only, with no code execution, file access, or persistence behavior. The scanner match is a keyword-level false positive on stylesheet syntax.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
frontend/src/components/portal/UserProfileContent.vue:470

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The flagged code is part of the project's code-quality checking setup. It checks whether the project is being built in production mode so it can turn on stricter warnings for developers. This is a completely normal, openly documented pattern and does not read, copy, or send any sensitive information anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The flagged construct is the lint configuration file comparing a build-time environment flag to a constant string in order to enable or disable console and debugger lint rules. This is the standard, documented pattern for this lint tool, runs only in the developer toolchain, is fully visible in source, reads a single well-known environment variable, and sends the value nowhere. There is no credential handling, no serialization of environment contents to any destination, and no runtime or user-facing behavior. The scanner signal is a false positive on a benign environment-variable comparison.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.serialize-environment
File role
production
Source
frontend/.eslintrc.cjs:17

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is styling code for the sidebar's spacing and background on the profile page. It cannot affect files, settings, or startup behavior on your machine.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a scoped CSS selector for the profile sidebar that sets its padding, background, border, and spacing. It is declarative styling with no executable behavior, no data flow, and no persistence capability. The scanner match is a false positive on stylesheet syntax.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
frontend/src/components/portal/UserProfileContent.vue:457

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

The flagged line is ordinary styling code that controls the spacing and layout of the main profile content area. It has no ability to change files, settings, or startup behavior on your computer.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a scoped CSS selector for the profile main content panel that sets padding, flex direction, and spacing. It is declarative presentation styling with no execution, no data flow, and no persistence capability. The surrounding file's actual logic consists of authenticated fetch calls to the application's own backend API for profile bio, language, and avatar management, which matches the project's stated purpose. The scanner match is a false positive on stylesheet syntax.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.persistence.startup-modification
File role
production
Source
frontend/src/components/portal/UserProfileContent.vue:662

Coverage and limitations

Inventory
574 files · 71713044 bytes
Contextual coverage
65 of 65 candidates assessed

JavaScript coverage

Status
Incomplete
Candidates
44 files · 308921 bytes
X-Ray review families
2 warning occurrences compacted to 1 evidence-preserving review families
Representations
44 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans
44 raw signatures · 7 raw AST · 44 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity
Full commit
de741a18276cbfbae50c0175c4aec605f42fbfd0
Completed
History depth
8 commits
Method
Deterministic evidence with contextual review
Reviewer
nano-gpt.com · zai-org/glm-latest
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
0 fresh / 5 reused groups · 0 fresh / 8 reused candidates
Review source reports
4a36a559cac617910d10c9c3aab623d459a4f3ab156de0ee9ee1b65e3045e7b2
Evidence triage
57 deterministic / 8 contextual candidates · 5 contextual / 13 total behavior cases
Model budget
0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage
0 input · 0 output · 0 cache read · 0 reasoning tokens
Report
f179e89f31579c067567b8d6e7865ef27b1d79692143aeee724896efc493436e