What this review found
No material or immediate-danger item was identified.
Minor cautions
zizmor reported unpinned-uses
Minor caution · high confidence
The CI pipeline uses a version label for a GitHub Action instead of locking it to a specific code snapshot. If someone hijacked that action's repository and changed what the label points to, they could run bad code during automated testing. The risk is low because the pipeline has limited permissions and no sensitive secrets.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow references actions/setup-python using a major-version floating tag rather than a pinned commit SHA. If the tag were ever moved to a malicious commit by a compromised maintainer or account takeover, the action could execute arbitrary code in CI. The workflow has contents:read permissions and does not handle secrets beyond the default GITHUB_TOKEN, limiting blast radius. This is a widely adopted convention but falls short of strict supply-chain hardening.
Impact: low · Exploitability: unlikely
Developer action: Pin the action to a full commit SHA with a version comment for reproducibility and supply-chain integrity.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:24
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · medium confidence
A tool used during development likely has a known security issue, but because this is a frontend app, the affected tool is probably not included in the final product that users actually run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: This medium-severity advisory was matched in a frontend project whose production dependencies are limited to vue, vue-router, dompurify, dagre, roughjs, font packages, and icon libraries, all at recent versions. The dev toolchain includes vite, postcss, tailwindcss, eslint, and typescript. Medium-severity advisories in this ecosystem most commonly affect build-time or dev-server tooling that is not present in the shipped static bundle. Without the specific package name (removed by the scanner), the most probable target is a dev dependency, meaning the vulnerable code has no runtime reachability for end users of the built frontend.
Impact: low · Exploitability: plausible
Developer action: Update the flagged dependency to a patched version when convenient. Run npm audit to identify the specific package and confirm whether it is a dev or production dependency.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- frontend/package-lock.json
zizmor reported unpinned-uses
Minor caution · high confidence
The checkout step in the CI pipeline uses a version label instead of a locked code snapshot. A compromised action repository could swap malicious code under that label. The impact is limited because the pipeline only has read access and does not publish or upload anything.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow references actions/checkout using a major-version floating tag rather than a pinned commit SHA. The same supply-chain tag-substitution risk applies. The workflow permissions are restricted to contents:read and no artifacts are uploaded, so credential leakage or token abuse through this action is minimal. Standard practice, but not maximally hardened.
Impact: low · Exploitability: unlikely
Developer action: Pin the action to a full commit SHA with a version comment for reproducibility and supply-chain integrity.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:21
Dependency advisory GHSA-3jxr-9vmj-r5cp applies
Minor caution · medium confidence
A development tool used to build this app has a serious-sounding security flaw, but it most likely only affects programmers running the app in development mode, not the people using the finished product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-3jxr-9vmj-r5cp to a dependency declared by this repository.
Contextual assessment: This high-severity advisory was matched in a frontend project that builds to static files via Vite. The production dependency set is minimal and uses recent versions (dompurify 3.4.11, vue 3.4+, vue-router 4.3+). High-severity advisories in Vite-based frontend projects frequently target the development server or esbuild, which are dev-only dependencies absent from the production bundle. The vulnerable code would only be reachable when a developer runs the local dev server, not when end users interact with the built application. Advisory severity alone does not establish end-user harm when the affected code is not shipped.
Impact: low · Exploitability: plausible
Developer action: Update the flagged dependency to a patched version. Run npm audit to confirm the specific package and verify it is not a production dependency.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-3jxr-9vmj-r5cp
- File role
- production
- Source
- frontend/package-lock.json
Dependency advisory GHSA-c2j3-45gr-mqc4 applies
Minor caution · medium confidence
A minor security note was flagged for a tool or library in this project. The impact is small and it probably affects only development tools, not the app users interact with.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-c2j3-45gr-mqc4 to a dependency declared by this repository.
Contextual assessment: This low-severity advisory was matched in a frontend project with a small, recently-versioned production dependency set. Low-severity advisories in this ecosystem typically involve edge-case behavior in build tooling or transitive dev dependencies with minimal real-world impact. The production dependencies (vue, vue-router, dompurify, dagre, roughjs) are all at recent versions unlikely to carry known low-severity issues. The advisory most likely targets a dev-only transitive dependency with no runtime reachability in the shipped bundle.
Impact: low · Exploitability: unlikely
Developer action: Update the flagged dependency when convenient. Run npm audit to identify the specific package.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-c2j3-45gr-mqc4
- File role
- production
- Source
- frontend/package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · medium confidence
A serious security issue was found in a development tool, but it most likely only affects developers working on the code locally, not users of the finished app.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory was matched in a frontend project that compiles to static assets. The production dependencies are minimal and current. High-severity advisories commonly seen in Vite-based projects target the dev server (file disclosure, DNS rebinding) or esbuild, both of which are dev dependencies excluded from the production build. The vulnerable code would only be reachable during local development, not in the deployed static frontend. Without the specific package name, the project structure strongly suggests a dev-only impact.
Impact: low · Exploitability: plausible
Developer action: Update the flagged dependency to a patched version. Run npm audit to confirm the specific package and whether it ships in production.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- frontend/package-lock.json
Dependency advisory GHSA-52cp-r559-cp3m applies
Minor caution · medium confidence
A high-severity security issue was flagged, but in this frontend project it most likely affects a build tool that is not part of the app users actually use.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-52cp-r559-cp3m to a dependency declared by this repository.
Contextual assessment: This high-severity advisory was matched in a frontend project with a small set of recent production dependencies. The build toolchain (vite, postcss, tailwindcss, eslint, typescript) constitutes the majority of the dependency tree and is the most common source of high-severity advisories in this project type. These tools operate at build time or during local development and are not included in the static production bundle served to users. The advisory severity does not translate to end-user harm when the vulnerable code is not shipped.
Impact: low · Exploitability: plausible
Developer action: Update the flagged dependency to a patched version. Run npm audit to identify the specific package and confirm it is dev-only.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-52cp-r559-cp3m
- File role
- production
- Source
- frontend/package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Minor caution · medium confidence
A serious security flaw was found in what is most likely a development or build tool for this frontend app, meaning it probably does not affect the people using the finished product.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: This high-severity advisory was matched in a frontend project whose production dependencies are limited to well-maintained packages at recent versions. The dev dependency tree includes vite, esbuild (transitive), postcss, tailwindcss, and eslint, which are the most frequent sources of high-severity advisories in Vite-based frontends. These dependencies are used during development and build time only and do not appear in the shipped static bundle. Without the specific package identification, the project context indicates the vulnerable code likely has no runtime reachability for end users.
Impact: low · Exploitability: plausible
Developer action: Update the flagged dependency to a patched version. Run npm audit to confirm the specific package and whether it is a production dependency.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- frontend/package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Minor caution · medium confidence
A high-severity security issue was flagged for a dependency, but in this frontend project it most likely affects a development tool that is not shipped to users.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: This high-severity advisory was matched in a frontend project that produces static assets for the browser. The production dependency set is small and uses current versions. The majority of the dependency tree consists of dev tooling (vite, postcss, tailwindcss, eslint, typescript and their transitive dependencies), which is the typical source of high-severity advisories in this project type. Dev tooling is excluded from the production build, so the vulnerable code would not be reachable by end users. The advisory severity reflects the worst-case scenario for the vulnerable package, not necessarily the impact in this specific deployment context.
Impact: low · Exploitability: plausible
Developer action: Update the flagged dependency to a patched version. Run npm audit to identify the specific package and verify it is not a production dependency.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- frontend/package-lock.json
Expected scanner matches (9)
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is just a styling rule for how a sidebar looks on the user profile page. It has nothing to do with persistence or modifying how the app starts up.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The matched line is a CSS class selector inside a scoped style block of a Vue single-file component. It defines visual layout properties for a sidebar element and has no relationship to startup persistence, execution, or system modification.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- frontend/src/components/portal/UserProfileContent.vue:492
Credential access and network transmission in one file
Expected behavior · high confidence
The code sends the user's login token to the app's own server to load saved game data. This is exactly what a logged-in web app is supposed to do, and the token is not sent anywhere unexpected.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The flagged line is a fetch call to the project's own backend adventure chat endpoint, using an Authorization Bearer header built from the application's auth state. This is standard authenticated API access for a frontend composable whose stated purpose is loading and syncing game session data. The token is sent only to the application backend, not to a third party, and the request is initiated by normal user-driven session refresh logic. No exfiltration, obfuscation, or unexpected destination is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 3
- Rule
- credential-exfiltration
- File role
- production
- Source
- frontend/src/composables/useGameSocket.ts:173
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is a visual styling rule for a card layout on the profile page. It does not affect app startup or persistence in any way.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The matched line is a CSS class selector within a scoped style block, defining layout dimensions and background styling for a profile card container. No executable code, persistence mechanism, or startup behavior is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- frontend/src/components/portal/UserProfileContent.vue:450
malcontent reported exec-shell-background_launcher
Expected behavior · high confidence
This is a standard setup script that prepares the application to run on your computer. Starting background processes is a normal part of setting up and running a local application, and there is no sign of any malicious activity here.
Technical evidence
Scanner reason: malcontent matched behavioral-analysis rule exec-shell-background_launcher in this repository.
Contextual assessment: The scanner flagged a capability related to launching background processes from relative paths. The supplied source context shows a standard bash setup script for a local, self-hosted project. It creates a Python virtual environment, copies environment files, and prepares to install dependencies. Launching local development servers or build processes in the background is a normal and expected capability for a project setup script. There is no evidence of obfuscation, external exfiltration, or malicious execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- malcontent 1.25.7
- Rule
- exec-shell-background_launcher
- File role
- production
- Source
- setup.sh
zizmor reported artipacked
Expected behavior · high confidence
The scanner flagged a possible credential-leakage pattern, but this pipeline never creates or uploads any build artifacts and has read-only access. There is no realistic way for credentials to be exposed through artifacts here.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked rule flags potential credential persistence through artifacts. This workflow does not upload, download, or share any artifacts. Permissions are explicitly scoped to contents:read. While actions/checkout defaults to persist-credentials true, no subsequent step performs git push or any operation that would exfiltrate the token, and no artifact is produced that could retain it. There is no concrete credential-exposure path in this workflow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:20-21
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is a help-doc command that asks a local image-generation program for its model list and then neatly formats the response. It does not download or run any software.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The flagged line is a documentation example that pipes the output of a local HTTP API query to python -m json.tool, a standard-library JSON pretty-printer. No downloaded content is executed as code. The request targets localhost only and the pipeline merely formats JSON for readability, which matches the stated purpose of verifying a local Stable Diffusion daemon.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs/HOWTO_LOCAL_STABLE_DIFFUSION.md:155
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is a layout rule for a dashboard grid on the profile page. It is purely visual and unrelated to startup persistence.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The matched line is a CSS class selector in a scoped style block defining a grid layout for a dashboard section. It contains only presentation properties and no logic, execution, or persistence behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- frontend/src/components/portal/UserProfileContent.vue:470
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This is a styling rule for the profile page container. It only controls appearance and layout, with no connection to startup persistence.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The matched line is a CSS class selector in a scoped style block defining padding, overflow, and sizing for a profile container. No executable or persistence-related code is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- frontend/src/components/portal/UserProfileContent.vue:457
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
The flagged code is just visual styling for a user profile panel. It does not store, save, or persist anything, and cannot affect the system at startup.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The flagged line is a CSS class selector for a profile layout panel in a Vue single-file component. It contains only styling properties and performs no script execution, storage access, network calls, or persistence behavior. The scanner match is a false positive on declarative style markup.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- frontend/src/components/portal/UserProfileContent.vue:662