What this review found
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Material concern · medium confidence
A known security issue was found in one of the app's third-party code libraries. Because the app runs locally on your own computer rather than on a public server, the risk is lower, but the library should still be updated.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-rgw5-rvv9-x895) against a dependency declared in this production lockfile. The scanner removed specific package details, so the exact affected package and its position in the dependency tree cannot be confirmed from the supplied evidence alone. The visible lockfile entries show a mix of dev-only packages (Babel, CSS tooling, test frameworks) and production packages (Capacitor, React, transformers). This is a self-hosted local frontend application, which limits the attack surface since the user runs it on their own machine and typically controls all inputs. Without confirming whether the affected package is a dev or production dependency and whether attacker-controlled input reaches the vulnerable code path, runtime reachability and concrete user harm remain uncertain.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version. If it is a dev-only dependency, prioritize accordingly.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-xcpc-8h2w-3j85 applies
Material concern · medium confidence
A known security issue was found in one of the app's third-party code libraries. The app runs locally, which reduces risk, but the library should be updated to a fixed version.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-xcpc-8h2w-3j85 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-xcpc-8h2w-3j85) against a dependency in this lockfile. Package details were removed by the scanner, preventing confirmation of the specific package, its version, and whether it is a dev or production dependency. The project is a self-hosted local frontend TTRPG engine, meaning the runtime attack surface is limited to user-controlled inputs on the user's own machine. Without identifying the package and its runtime reachability, concrete user harm cannot be confirmed but cannot be ruled out.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-xcpc-8h2w-3j85
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-mh99-v99m-4gvg applies
Material concern · medium confidence
A known security issue was found in one of the app's third-party code libraries. The app runs locally which reduces risk, but the high severity rating means the library should be updated.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-mh99-v99m-4gvg) against a dependency in this lockfile. Package details were removed, so the specific affected package and its dependency chain position cannot be confirmed. The project is a self-hosted local frontend application, which limits the attack surface. However, high-severity advisories warrant attention even in local apps, particularly if the affected package processes external data such as LLM responses or user-imported content.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-4cwx-7wf7-3272 applies
Material concern · medium confidence
A known security issue was found in one of the app's third-party code libraries. The local nature of the app reduces risk, but the high severity means the library should be updated.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-4cwx-7wf7-3272 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-4cwx-7wf7-3272) against a dependency in this lockfile. The scanner removed package details, preventing confirmation of the specific package and whether it is a dev or production dependency. The self-hosted local nature of this frontend project limits the attack surface, but high-severity advisories in production dependencies could present real risk if attacker-controlled input reaches the vulnerable code path.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-4cwx-7wf7-3272
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-f88m-g3jw-g9cj applies
Material concern · medium confidence
A known security issue was found in one of the app's third-party code libraries. The app runs locally which reduces risk, but the high severity rating means the library should be updated.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-f88m-g3jw-g9cj to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-f88m-g3jw-g9cj) against a dependency in this lockfile. Package details were removed, so the specific affected package cannot be confirmed. The project is a self-hosted local frontend TTRPG engine with limited attack surface, but high-severity advisories warrant investigation to determine whether the affected package is a production dependency with runtime reachability.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-f88m-g3jw-g9cj
- File role
- production
- Source
- mobile/package-lock.json
Minor cautions
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · low confidence
A security scanner found a known vulnerability in one of the packages listed in this project's dependency lock file. However, this particular sub-package appears to only use development tools (not anything that runs when the app is used by players), so the vulnerability likely does not affect the running application. The exact vulnerable package could not be confirmed from the available file excerpt.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: The advisory GHSA-r28c-9q8g-f849 was matched by OSV-scanner against a dependency in this lockfile. The root package section of file declares only devDependencies (typescript and vitest) with no production dependencies key. Visible transitive dependencies such as the @emnapi family are marked dev:true and optional:true, indicating they are development-time only. Because the specific vulnerable package cannot be identified from the truncated source and the scanner redacted package details, runtime reachability and attacker-controlled input paths cannot be confirmed. However, the absence of production dependencies in the root package strongly suggests this advisory affects a development-only dependency, limiting production user harm. Advisory severity alone does not establish immediate danger.
Impact: low · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version when convenient. Run npm audit in the packages/engine directory to identify the specific package and upgrade it.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- packages/engine/package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · low confidence
A security scanner found a medium-severity vulnerability in a dependency used by this sub-package. Since this sub-package only lists development tools and no production dependencies, the issue probably does not affect the app when players use it. The exact package could not be confirmed from the available file excerpt.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: The advisory GHSA-fxqj-rqcc-2cmp was matched by OSV-scanner against a dependency in this lockfile. The root package in file declares only devDependencies (typescript and vitest) with no production dependencies. Visible transitive dependencies are marked dev:true and optional:true. The specific vulnerable package was redacted by the scanner and the source is truncated, so the exact dependency, its version, and runtime reachability cannot be independently confirmed. Given the dev-only dependency structure of this sub-package, production runtime impact is likely limited. The medium advisory severity does not by itself establish material production risk.
Impact: low · Exploitability: unlikely
Developer action: Update the affected devDependency to a patched version when convenient. Run npm audit in the packages/engine directory to identify the specific package and upgrade it.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- packages/engine/package-lock.json
Dependency advisory GHSA-r292-9mhp-454m applies
Minor caution · medium confidence
A minor known security issue was found in one of the app's third-party code libraries. Since the app runs locally and the issue is rated medium severity, the risk is low, but updating the library is still good practice.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r292-9mhp-454m to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-r292-9mhp-454m) against a dependency in this lockfile. Package details were removed, so the specific affected package cannot be confirmed. Given the project is a self-hosted local frontend application with limited external attack surface, and the advisory is medium severity, the concrete user harm is likely low. Many dependencies visible in the lockfile are dev-only build tools that do not ship to end users.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r292-9mhp-454m
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · medium confidence
A minor known security issue was found in one of the app's third-party code libraries. The risk is low given the local nature of the app, but updating is recommended.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-fxqj-rqcc-2cmp) against a dependency in this lockfile. The scanner removed package details, preventing identification of the specific affected package. The project is a self-hosted local frontend app where the user controls inputs, limiting the attack surface. Medium-severity advisories in this context typically present low concrete harm, especially if the affected package is a dev-only build tool.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-fxqj-rqcc-2cmp applies
Minor caution · low confidence
A scanner found a medium-severity security issue in one of the project's third-party code libraries, but didn't specify which library. Since this app runs entirely on your own computer (not on the internet), the risk is limited. The issue may be in a development-only tool that doesn't affect the running application.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp (medium severity) against a dependency in file, but the specific package name was removed from the scanner output. The lockfile contains both production and dev dependencies; the visible portion of the file shows mostly dev-only packages (Babel, CSSTools, esbuild platform binaries). The project is a self-hosted local application that runs on localhost, which limits the attack surface to the local machine. Without identifying the specific affected package, its dependency chain (dev vs production), and whether attacker-controlled input reaches the vulnerable code at runtime, the concrete user harm cannot be confirmed. The local-only deployment model further reduces practical risk.
Impact: low · Exploitability: plausible
Developer action: Run npm audit to identify the specific package and version. If it is a production dependency, update to a patched version. If it is a dev-only dependency, consider updating when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-fxqj-rqcc-2cmp
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-m8rv-5g2x-5cg5 applies
Minor caution · medium confidence
A minor known security issue was found in one of the app's third-party code libraries. The risk is low given the local nature of the app, but updating is recommended.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-m8rv-5g2x-5cg5) against a dependency in this lockfile. Package details were removed by the scanner. The project is a self-hosted local frontend application with limited external attack surface. Medium-severity advisories in this context, particularly if in dev-only build dependencies, present low concrete user harm.
Impact: low · Exploitability: unlikely
Developer action: Run npm audit to identify the specific package and update it when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-m8rv-5g2x-5cg5
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-jr45-8vmc-qm54 applies
Minor caution · medium confidence
A tool used behind the scenes during development or installation has a known security issue, but it does not affect the app that users actually run on their phones.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-jr45-8vmc-qm54 to a dependency declared by this repository.
Contextual assessment: This advisory (GHSA-jr45-8vmc-qm54) corresponds to a known vulnerability in a build-toolchain or install-time dependency. The project is a Capacitor-based mobile frontend; such dependencies are used during npm install or development builds and are not bundled into the production mobile application. The vulnerable code path is not reachable at runtime for end users of the shipped app. The lock file confirms the project's production dependencies are Capacitor runtime packages, React, and local embedding libraries, none of which would exercise this vulnerable dependency at runtime.
Impact: low · Exploitability: unlikely
Developer action: Update the affected dev or build dependency to a patched version when convenient; no urgent action is required for end-user safety.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-jr45-8vmc-qm54
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-8xcm-r25x-g524 applies
Minor caution · medium confidence
A code-checking tool used only by developers has a security flaw. It has no effect on the finished app that users install and run.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.
Contextual assessment: This advisory (GHSA-8xcm-r25x-g524) corresponds to a sandbox-escape issue in an ESLint-related package. The lock file lists @eslint/js as a devDependency, confirming this is a linting-time tool used only during development. ESLint and its plugin tooling are never included in a production Capacitor mobile build, so the vulnerable code has no runtime reachability for end users. The issue would only be exploitable if a developer linted untrusted code with a vulnerable configuration.
Impact: low · Exploitability: unlikely
Developer action: Update the ESLint-related dev dependency to a patched version during routine maintenance; no end-user risk is present.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-8xcm-r25x-g524
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Minor caution · low confidence
A scanner found a high-severity security issue in one of the project's third-party code libraries, but didn't specify which library. Because this app runs locally on your own computer rather than on a public server, the practical danger is much lower than the severity rating suggests. The vulnerable library may also be a development-only tool that isn't part of the running app.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 (high severity) against a dependency in file, but the specific package name was removed from the scanner output. The lockfile declares both production dependencies (express, better-sqlite3, cors, etc.) and dev dependencies (vite, esbuild, vitest, etc.). The visible source context shows only the first 640 lines of a 345,933-byte lockfile, predominantly dev-only packages. The project is explicitly self-hosted and runs on localhost, meaning any server-side vulnerability in production dependencies would only be reachable from the local machine or local network. Without knowing the specific affected package, whether it is a dev or production dependency, and whether attacker-controlled input reaches the vulnerable code path, the advisory severity alone cannot establish concrete user harm. The local deployment model significantly constrains exploitability compared to a public-facing service.
Impact: low · Exploitability: plausible
Developer action: Run npm audit to identify the specific package and version. If it is a production dependency with runtime reachability, update to a patched version promptly. If it is a dev-only dependency, update when convenient.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- package-lock.json
Dependency advisory GHSA-r28c-9q8g-f849 applies
Minor caution · medium confidence
The development preview server has a flaw that could let a malicious website send requests to it while a developer is working. This does not affect the finished mobile app at all.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.
Contextual assessment: This advisory (GHSA-r28c-9q8g-f849) corresponds to the esbuild development server cross-origin request vulnerability. The project uses Vite (via @tailwindcss/vite devDependency) which bundles esbuild as a transitive dependency. The vulnerable code is the esbuild dev server, which only runs when a developer executes a local dev build. In a production Capacitor mobile build, the dev server is not instantiated, so the vulnerability has no runtime reachability for end users. The risk is limited to a developer visiting a malicious website while their dev server is running locally.
Impact: low · Exploitability: plausible
Developer action: Update Vite and esbuild to patched versions during routine development maintenance; no action is needed for released builds.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-r28c-9q8g-f849
- File role
- production
- Source
- mobile/package-lock.json
Dependency advisory GHSA-v3r7-h72x-cjcm applies
Minor caution · medium confidence
The development build tool has a flaw in its local preview server. This only matters while developers are testing locally and has no impact on the app users install.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.
Contextual assessment: This advisory (GHSA-v3r7-h72x-cjcm) corresponds to a Vite development server exposure issue. The lock file lists @tailwindcss/vite as a devDependency, confirming Vite is used only as a build tool. The vulnerable code path involves the Vite dev server, which is not present in a production Capacitor mobile build. End users of the shipped app are not affected. The exposure is limited to developers running the local dev server.
Impact: low · Exploitability: plausible
Developer action: Update Vite to a patched version during routine development maintenance; no end-user-facing risk exists.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-v3r7-h72x-cjcm
- File role
- production
- Source
- mobile/package-lock.json
Expected scanner matches (3)
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a fake test value used inside a unit test to check that the app's encryption actually hides secret text. It is not a real password or API key, and it never leaves the test file.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched a string on line 291 of a Vitest test file. The matched value is a local test fixture assigned to a variable named 'secret' and used solely to assert that the encryption output does not contain the plaintext and is longer than it. This is a synthetic placeholder value, not a real credential, and it is confined to a test scope. No runtime credential exposure or exfiltration occurs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- test
- Source
- src/services/infrastructure/__tests__/settingsCrypto.test.ts:291
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This file is an automatically generated helper for running ONNX AI models in the browser. The flagged code is a standard part of how these generated helpers wire up internal functions. It does not take input from users or the internet, and it is a normal part of a legitimate library.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function(...)` at line 49 is part of Emscripten's embind method-caller generation inside an ONNX Runtime WebAssembly glue file. The function body is assembled from internal type-registration metadata (argument converters and return-value handlers) produced by the compiled WASM module, not from user input or external network data. This is a standard, well-known pattern in Emscripten-generated bindings and is consistent with the project's stated use of local ONNX models via @huggingface/transformers.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- mobile/public/ort/ort-wasm-simd-threaded.asyncify.mjs:49
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a fake placeholder used only in a test that checks the app's encryption actually hides secret values. It is not a real API key and is not exposed to anyone.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a test fixture string assigned to a local variable named secret inside a unit test that verifies encryption ciphertext does not contain the plaintext. The value was already redacted by the scanner, and the surrounding test asserts the encrypted output excludes the input and is longer due to IV and GCM tag. No real credential is present, and the value is never sent anywhere.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- test
- Source
- src/services/infrastructure/__tests__/settingsCrypto.test.ts:291