TavernKeeper Scan Report

Sagesheep/NarrativeEngine-P

Commit 3c3ed4f Reviewed

5 material concerns identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 5 material 14 low

What this review found

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Material concern · medium confidence

A known security issue was found in one of the app's third-party code libraries. Because the app runs locally on your own computer rather than on a public server, the risk is lower, but the library should still be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-rgw5-rvv9-x895) against a dependency declared in this production lockfile. The scanner removed specific package details, so the exact affected package and its position in the dependency tree cannot be confirmed from the supplied evidence alone. The visible lockfile entries show a mix of dev-only packages (Babel, CSS tooling, test frameworks) and production packages (Capacitor, React, transformers). This is a self-hosted local frontend application, which limits the attack surface since the user runs it on their own machine and typically controls all inputs. Without confirming whether the affected package is a dev or production dependency and whether attacker-controlled input reaches the vulnerable code path, runtime reachability and concrete user harm remain uncertain.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version. If it is a dev-only dependency, prioritize accordingly.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rgw5-rvv9-x895
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-xcpc-8h2w-3j85 applies

Material concern · medium confidence

A known security issue was found in one of the app's third-party code libraries. The app runs locally, which reduces risk, but the library should be updated to a fixed version.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-xcpc-8h2w-3j85 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-xcpc-8h2w-3j85) against a dependency in this lockfile. Package details were removed by the scanner, preventing confirmation of the specific package, its version, and whether it is a dev or production dependency. The project is a self-hosted local frontend TTRPG engine, meaning the runtime attack surface is limited to user-controlled inputs on the user's own machine. Without identifying the package and its runtime reachability, concrete user harm cannot be confirmed but cannot be ruled out.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-xcpc-8h2w-3j85
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-mh99-v99m-4gvg applies

Material concern · medium confidence

A known security issue was found in one of the app's third-party code libraries. The app runs locally which reduces risk, but the high severity rating means the library should be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-mh99-v99m-4gvg) against a dependency in this lockfile. Package details were removed, so the specific affected package and its dependency chain position cannot be confirmed. The project is a self-hosted local frontend application, which limits the attack surface. However, high-severity advisories warrant attention even in local apps, particularly if the affected package processes external data such as LLM responses or user-imported content.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-mh99-v99m-4gvg
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-4cwx-7wf7-3272 applies

Material concern · medium confidence

A known security issue was found in one of the app's third-party code libraries. The local nature of the app reduces risk, but the high severity means the library should be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4cwx-7wf7-3272 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-4cwx-7wf7-3272) against a dependency in this lockfile. The scanner removed package details, preventing confirmation of the specific package and whether it is a dev or production dependency. The self-hosted local nature of this frontend project limits the attack surface, but high-severity advisories in production dependencies could present real risk if attacker-controlled input reaches the vulnerable code path.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4cwx-7wf7-3272
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-f88m-g3jw-g9cj applies

Material concern · medium confidence

A known security issue was found in one of the app's third-party code libraries. The app runs locally which reduces risk, but the high severity rating means the library should be updated.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-f88m-g3jw-g9cj to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a high-severity advisory (GHSA-f88m-g3jw-g9cj) against a dependency in this lockfile. Package details were removed, so the specific affected package cannot be confirmed. The project is a self-hosted local frontend TTRPG engine with limited attack surface, but high-severity advisories warrant investigation to determine whether the affected package is a production dependency with runtime reachability.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit or osv-scanner with full output to identify the specific affected package, then update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-f88m-g3jw-g9cj
File role
production
Source
mobile/package-lock.json

Minor cautions

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · low confidence

A security scanner found a known vulnerability in one of the packages listed in this project's dependency lock file. However, this particular sub-package appears to only use development tools (not anything that runs when the app is used by players), so the vulnerability likely does not affect the running application. The exact vulnerable package could not be confirmed from the available file excerpt.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: The advisory GHSA-r28c-9q8g-f849 was matched by OSV-scanner against a dependency in this lockfile. The root package section of file declares only devDependencies (typescript and vitest) with no production dependencies key. Visible transitive dependencies such as the @emnapi family are marked dev:true and optional:true, indicating they are development-time only. Because the specific vulnerable package cannot be identified from the truncated source and the scanner redacted package details, runtime reachability and attacker-controlled input paths cannot be confirmed. However, the absence of production dependencies in the root package strongly suggests this advisory affects a development-only dependency, limiting production user harm. Advisory severity alone does not establish immediate danger.

Impact: low · Exploitability: unlikely

Developer action: Update the affected devDependency to a patched version when convenient. Run npm audit in the packages/engine directory to identify the specific package and upgrade it.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
packages/engine/package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · low confidence

A security scanner found a medium-severity vulnerability in a dependency used by this sub-package. Since this sub-package only lists development tools and no production dependencies, the issue probably does not affect the app when players use it. The exact package could not be confirmed from the available file excerpt.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: The advisory GHSA-fxqj-rqcc-2cmp was matched by OSV-scanner against a dependency in this lockfile. The root package in file declares only devDependencies (typescript and vitest) with no production dependencies. Visible transitive dependencies are marked dev:true and optional:true. The specific vulnerable package was redacted by the scanner and the source is truncated, so the exact dependency, its version, and runtime reachability cannot be independently confirmed. Given the dev-only dependency structure of this sub-package, production runtime impact is likely limited. The medium advisory severity does not by itself establish material production risk.

Impact: low · Exploitability: unlikely

Developer action: Update the affected devDependency to a patched version when convenient. Run npm audit in the packages/engine directory to identify the specific package and upgrade it.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
packages/engine/package-lock.json

Dependency advisory GHSA-r292-9mhp-454m applies

Minor caution · medium confidence

A minor known security issue was found in one of the app's third-party code libraries. Since the app runs locally and the issue is rated medium severity, the risk is low, but updating the library is still good practice.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r292-9mhp-454m to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-r292-9mhp-454m) against a dependency in this lockfile. Package details were removed, so the specific affected package cannot be confirmed. Given the project is a self-hosted local frontend application with limited external attack surface, and the advisory is medium severity, the concrete user harm is likely low. Many dependencies visible in the lockfile are dev-only build tools that do not ship to end users.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r292-9mhp-454m
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · medium confidence

A minor known security issue was found in one of the app's third-party code libraries. The risk is low given the local nature of the app, but updating is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-fxqj-rqcc-2cmp) against a dependency in this lockfile. The scanner removed package details, preventing identification of the specific affected package. The project is a self-hosted local frontend app where the user controls inputs, limiting the attack surface. Medium-severity advisories in this context typically present low concrete harm, especially if the affected package is a dev-only build tool.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · low confidence

A scanner found a medium-severity security issue in one of the project's third-party code libraries, but didn't specify which library. Since this app runs entirely on your own computer (not on the internet), the risk is limited. The issue may be in a development-only tool that doesn't affect the running application.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp (medium severity) against a dependency in file, but the specific package name was removed from the scanner output. The lockfile contains both production and dev dependencies; the visible portion of the file shows mostly dev-only packages (Babel, CSSTools, esbuild platform binaries). The project is a self-hosted local application that runs on localhost, which limits the attack surface to the local machine. Without identifying the specific affected package, its dependency chain (dev vs production), and whether attacker-controlled input reaches the vulnerable code at runtime, the concrete user harm cannot be confirmed. The local-only deployment model further reduces practical risk.

Impact: low · Exploitability: plausible

Developer action: Run npm audit to identify the specific package and version. If it is a production dependency, update to a patched version. If it is a dev-only dependency, consider updating when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
package-lock.json

Dependency advisory GHSA-m8rv-5g2x-5cg5 applies

Minor caution · medium confidence

A minor known security issue was found in one of the app's third-party code libraries. The risk is low given the local nature of the app, but updating is recommended.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-m8rv-5g2x-5cg5 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a medium-severity advisory (GHSA-m8rv-5g2x-5cg5) against a dependency in this lockfile. Package details were removed by the scanner. The project is a self-hosted local frontend application with limited external attack surface. Medium-severity advisories in this context, particularly if in dev-only build dependencies, present low concrete user harm.

Impact: low · Exploitability: unlikely

Developer action: Run npm audit to identify the specific package and update it when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-m8rv-5g2x-5cg5
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-jr45-8vmc-qm54 applies

Minor caution · medium confidence

A tool used behind the scenes during development or installation has a known security issue, but it does not affect the app that users actually run on their phones.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-jr45-8vmc-qm54 to a dependency declared by this repository.

Contextual assessment: This advisory (GHSA-jr45-8vmc-qm54) corresponds to a known vulnerability in a build-toolchain or install-time dependency. The project is a Capacitor-based mobile frontend; such dependencies are used during npm install or development builds and are not bundled into the production mobile application. The vulnerable code path is not reachable at runtime for end users of the shipped app. The lock file confirms the project's production dependencies are Capacitor runtime packages, React, and local embedding libraries, none of which would exercise this vulnerable dependency at runtime.

Impact: low · Exploitability: unlikely

Developer action: Update the affected dev or build dependency to a patched version when convenient; no urgent action is required for end-user safety.

Scanner
osv-scanner 2.4.0
Rule
GHSA-jr45-8vmc-qm54
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-8xcm-r25x-g524 applies

Minor caution · medium confidence

A code-checking tool used only by developers has a security flaw. It has no effect on the finished app that users install and run.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-8xcm-r25x-g524 to a dependency declared by this repository.

Contextual assessment: This advisory (GHSA-8xcm-r25x-g524) corresponds to a sandbox-escape issue in an ESLint-related package. The lock file lists @eslint/js as a devDependency, confirming this is a linting-time tool used only during development. ESLint and its plugin tooling are never included in a production Capacitor mobile build, so the vulnerable code has no runtime reachability for end users. The issue would only be exploitable if a developer linted untrusted code with a vulnerable configuration.

Impact: low · Exploitability: unlikely

Developer action: Update the ESLint-related dev dependency to a patched version during routine maintenance; no end-user risk is present.

Scanner
osv-scanner 2.4.0
Rule
GHSA-8xcm-r25x-g524
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-rgw5-rvv9-x895 applies

Minor caution · low confidence

A scanner found a high-severity security issue in one of the project's third-party code libraries, but didn't specify which library. Because this app runs locally on your own computer rather than on a public server, the practical danger is much lower than the severity rating suggests. The vulnerable library may also be a development-only tool that isn't part of the running app.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 (high severity) against a dependency in file, but the specific package name was removed from the scanner output. The lockfile declares both production dependencies (express, better-sqlite3, cors, etc.) and dev dependencies (vite, esbuild, vitest, etc.). The visible source context shows only the first 640 lines of a 345,933-byte lockfile, predominantly dev-only packages. The project is explicitly self-hosted and runs on localhost, meaning any server-side vulnerability in production dependencies would only be reachable from the local machine or local network. Without knowing the specific affected package, whether it is a dev or production dependency, and whether attacker-controlled input reaches the vulnerable code path, the advisory severity alone cannot establish concrete user harm. The local deployment model significantly constrains exploitability compared to a public-facing service.

Impact: low · Exploitability: plausible

Developer action: Run npm audit to identify the specific package and version. If it is a production dependency with runtime reachability, update to a patched version promptly. If it is a dev-only dependency, update when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-rgw5-rvv9-x895
File role
production
Source
package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · medium confidence

The development preview server has a flaw that could let a malicious website send requests to it while a developer is working. This does not affect the finished mobile app at all.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: This advisory (GHSA-r28c-9q8g-f849) corresponds to the esbuild development server cross-origin request vulnerability. The project uses Vite (via @tailwindcss/vite devDependency) which bundles esbuild as a transitive dependency. The vulnerable code is the esbuild dev server, which only runs when a developer executes a local dev build. In a production Capacitor mobile build, the dev server is not instantiated, so the vulnerability has no runtime reachability for end users. The risk is limited to a developer visiting a malicious website while their dev server is running locally.

Impact: low · Exploitability: plausible

Developer action: Update Vite and esbuild to patched versions during routine development maintenance; no action is needed for released builds.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
mobile/package-lock.json

Dependency advisory GHSA-v3r7-h72x-cjcm applies

Minor caution · medium confidence

The development build tool has a flaw in its local preview server. This only matters while developers are testing locally and has no impact on the app users install.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v3r7-h72x-cjcm to a dependency declared by this repository.

Contextual assessment: This advisory (GHSA-v3r7-h72x-cjcm) corresponds to a Vite development server exposure issue. The lock file lists @tailwindcss/vite as a devDependency, confirming Vite is used only as a build tool. The vulnerable code path involves the Vite dev server, which is not present in a production Capacitor mobile build. End users of the shipped app are not affected. The exposure is limited to developers running the local dev server.

Impact: low · Exploitability: plausible

Developer action: Update Vite to a patched version during routine development maintenance; no end-user-facing risk exists.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v3r7-h72x-cjcm
File role
production
Source
mobile/package-lock.json
Expected scanner matches (3)

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a fake test value used inside a unit test to check that the app's encryption actually hides secret text. It is not a real password or API key, and it never leaves the test file.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The gitleaks generic-api-key rule matched a string on line 291 of a Vitest test file. The matched value is a local test fixture assigned to a variable named 'secret' and used solely to assert that the encryption output does not contain the plaintext and is longer than it. This is a synthetic placeholder value, not a real credential, and it is confined to a test scope. No runtime credential exposure or exfiltration occurs.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
test
Source
src/services/infrastructure/__tests__/settingsCrypto.test.ts:291

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This file is an automatically generated helper for running ONNX AI models in the browser. The flagged code is a standard part of how these generated helpers wire up internal functions. It does not take input from users or the internet, and it is a normal part of a legitimate library.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The matched `new Function(...)` at line 49 is part of Emscripten's embind method-caller generation inside an ONNX Runtime WebAssembly glue file. The function body is assembled from internal type-registration metadata (argument converters and return-value handlers) produced by the compiled WASM module, not from user input or external network data. This is a standard, well-known pattern in Emscripten-generated bindings and is consistent with the project's stated use of local ONNX models via @huggingface/transformers.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
mobile/public/ort/ort-wasm-simd-threaded.asyncify.mjs:49

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a fake placeholder used only in a test that checks the app's encryption actually hides secret values. It is not a real API key and is not exposed to anyone.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a test fixture string assigned to a local variable named secret inside a unit test that verifies encryption ciphertext does not contain the plaintext. The value was already redacted by the scanner, and the surrounding test asserts the encrypted output excludes the input and is longer due to IV and GCM tag. No real credential is present, and the value is never sent anywhere.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
test
Source
src/services/infrastructure/__tests__/settingsCrypto.test.ts:291

Coverage and limitations

Tools

Limitations

Technical scan identity