What this review found
Dependency advisory GHSA-67mh-4wv8-2f99 applies
Material concern · low confidence
A scanner found a known issue in a dependency, but the supplied information does not identify the package, version, affected feature, or whether users can reach it.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-67mh-4wv8-2f99 to a dependency declared by this repository.
Contextual assessment: The advisory match is high-confidence scanner metadata, but package identity, resolved version, advisory conditions, runtime reachability, attacker-controlled input, and concrete impact are absent. The lockfile excerpt shows declarations but not the matched package or resolved artifact.
Impact: medium · Exploitability: plausible
Developer action: Provide the affected package name and installed version, then confirm whether the vulnerable functionality is reachable at runtime; upgrade or constrain the dependency if applicable.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-67mh-4wv8-2f99
- File role
- production
- Source
- bun.lock
Gitleaks reported private-key
Material concern · high confidence
This file contains private-key material in a test fixture. Anyone who can obtain the repository may be able to use it to impersonate or access systems if the corresponding key is accepted anywhere.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule private-key in this repository.
Contextual assessment: The scanner identified private-key material spanning the supplied fixture. The evidence does not establish whether the key is synthetic, public-only test data, or usable with a real certificate or service, so compromise is not proven; however, repository exposure of private-key material creates a substantial credential-management risk and warrants removal, history cleanup, and rotation where applicable.
Impact: high · Exploitability: plausible
Developer action: Remove the private-key material from the repository and its history, replace it with a clearly non-secret test fixture or generate it during tests, and rotate it if it was ever usable.
- Scanner
- gitleaks 8.30.1
- Rule
- private-key
- File role
- fixture
- Source
- services/api/test/fixtures/provider-proxy-key.pem:1-28
Dependency advisory GHSA-395f-4hp3-45gv applies
Material concern · low confidence
A high-severity dependency warning was reported, but there is not enough detail to determine whether this application is actually exposed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-395f-4hp3-45gv to a dependency declared by this repository.
Contextual assessment: The scanner reports a high-severity advisory match, but the supplied evidence omits package identity, resolved version, vulnerable code path, runtime reachability, attacker-controlled input, and resulting harm. Severity alone cannot establish immediate danger.
Impact: high · Exploitability: plausible
Developer action: Provide the affected package name and installed version, assess runtime reachability and attacker control, and remediate by upgrading or constraining the dependency where applicable.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-395f-4hp3-45gv
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-rgw5-rvv9-x895 applies
Material concern · low confidence
The scanner found a serious issue in an unnamed library, but the available record does not show whether the library is used in a risky way here.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-rgw5-rvv9-x895 to a dependency declared by this repository.
Contextual assessment: This is advisory metadata only: no dependency name, installed version, affected range, vulnerable operation, reachability, or attacker-input path is supplied. A contextual dependency assessment therefore remains materially uncertain.
Impact: high · Exploitability: plausible
Developer action: Identify the matched dependency and resolved version, determine whether the vulnerable code is shipped and reachable, and upgrade or constrain it if exposed.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-rgw5-rvv9-x895
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-mh99-v99m-4gvg applies
Material concern · low confidence
A dependency with a known high-severity problem was flagged, but the supplied evidence is too incomplete to say how users could be harmed.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-mh99-v99m-4gvg to a dependency declared by this repository.
Contextual assessment: The candidate contains only a high-confidence advisory match. The affected package, resolved version, vulnerable behavior, runtime use, attacker control, and concrete impact are unavailable, preventing a higher-confidence determination.
Impact: high · Exploitability: plausible
Developer action: Identify the affected dependency and version, verify runtime reachability and attacker control, then apply the vendor fix or a safe version constraint if the path is exposed.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-mh99-v99m-4gvg
- File role
- production
- Source
- bun.lock
Dependency advisory GHSA-gpj5-g38j-94v9 applies
Material concern · low confidence
Another high-severity library warning was reported, but the record does not identify the library or demonstrate an exploitable path in this project.
Technical evidence
Scanner reason: OSV-Scanner matched advisory GHSA-gpj5-g38j-94v9 to a dependency declared by this repository.
Contextual assessment: Only scanner metadata is available. Without package identity, resolved version, advisory mechanics, production reachability, attacker-controlled input, and concrete consequences, the finding cannot be classified as immediate high risk.
Impact: high · Exploitability: plausible
Developer action: Provide the matched package and resolved version, check whether its vulnerable functionality is reachable in production, and upgrade or constrain it if necessary.
- Scanner
- osv-scanner 2.4.0
- Rule
- GHSA-gpj5-g38j-94v9
- File role
- production
- Source
- bun.lock
Minor cautions
zizmor reported unpinned-uses
Minor caution · high confidence
The release workflow uses a moving version label for a third-party action, so a later upstream change could alter the build.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned action reference in a release job permits upstream tag movement or compromise to change code executed with release workflow privileges.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:328
zizmor reported cache-poisoning
Minor caution · low confidence
The scanner suspects that a build cache could supply an altered file, but the available evidence does not show what is cached or whether it is executed.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: Only a low-confidence scanner finding is supplied and the relevant workflow excerpt is unavailable. Cache poisoning cannot be confirmed without the cache configuration, key derivation, trust boundaries, and use of restored artifacts.
Impact: medium · Exploitability: plausible
Developer action: Inspect the omitted workflow lines and ensure caches do not restore or execute untrusted runtime artifacts; use immutable cache keys where applicable.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release.yml:270
zizmor reported artipacked
Minor caution · low confidence
The release process saves a build file for later use. The supplied excerpt does not show that secrets are included, but the workflow should ensure only intended release files are saved.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The scanner reports possible credential persistence through an uploaded artifact, but the available context shows an explicitly named release tarball and short retention. Artifact contents and the triggering lines are incomplete, so credential inclusion is not established.
Impact: low · Exploitability: unlikely
Developer action: Inspect the complete workflow and ensure artifact contents cannot include credentials or other sensitive runner files; upload only explicitly staged release outputs.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:161-163
zizmor reported unpinned-uses
Minor caution · high confidence
The release job downloads a third-party build component by a moving version label. If that label is changed or compromised, future releases could run altered code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is referenced by major version rather than an immutable commit. A mutable action reference creates a supply-chain substitution risk in a release workflow, although the supplied evidence does not show exploitation.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and document the corresponding version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:57
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving version label for a third-party automation component. If that label later points to harmful code, future builds could run it.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned action reference in a CI workflow. The supplied context does not show compromise or malicious behavior, but mutable references allow upstream changes to alter privileged runner execution.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA, preferably with an update process for reviewed upgrades.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:184
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow follows a movable action version, so a future change to that action could affect release builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is referenced by a version tag rather than an immutable commit. A tag update or compromised upstream release could alter CI behavior, although no malicious change is shown.
Impact: medium · Exploitability: plausible
Developer action: Pin the checkout action to a full commit SHA and review the selected commit before updating it.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:267
zizmor reported unpinned-uses
Minor caution · high confidence
The build uses a moving version of an external automation component. If that component changes unexpectedly, a build could run different code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow invokes an external action by version tag rather than an immutable commit. This creates a supply-chain and mutable-reference risk in CI, but the supplied context does not show malicious behavior or secret exposure.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to a reviewed immutable commit SHA.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:119
zizmor reported adhoc-packages
Minor caution · high confidence
The release job installs a package by name without locking it to an exact version, so a later package update could change the build environment.
Technical evidence
Scanner reason: zizmor matched workflow-security rule adhoc-packages in this repository.
Contextual assessment: The workflow installs the latest npm release dynamically during publishing. This introduces mutable external input into the release toolchain, but the evidence does not show malicious behavior or attacker-controlled package selection.
Impact: low · Exploitability: plausible
Developer action: Pin or otherwise control the npm tool version if reproducible builds are required.
- Scanner
- zizmor 1.28.0
- Rule
- adhoc-packages
- File role
- tooling
- Source
- .github/workflows/release-npm.yml:140
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build component by a movable version label. If that label were changed upstream, a release could run different code than expected.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is referenced by a version tag rather than an immutable commit. A tag change or compromised upstream action could alter release-job behavior, although the job checks out the intended repository revision and the evidence does not show exploitation.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced checkout action to an immutable commit digest and review all other workflow action references similarly.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:219
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build tool by movable version label, so a future upstream change could alter the code executed during builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned third-party GitHub Action in a release/build workflow. The supplied evidence does not show malicious behavior or secret exposure, but mutable references weaken supply-chain reproducibility.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a reviewed immutable commit SHA and document the selected version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:115
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving action version, so a future upstream change could alter what runs in CI.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The cited workflow step references an external action by a version tag rather than an immutable commit. This permits tag movement or upstream compromise to change CI behavior, although the supplied evidence does not show malicious behavior or exposed credentials.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a full commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:71
zizmor reported unpinned-uses
Minor caution · high confidence
A build step relies on a changeable third-party version label, so a later upstream change could affect CI runs.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The finding is an unpinned action invocation. This is a supply-chain hardening issue rather than evidence of current abuse; the excerpt shows ordinary artifact retrieval in a test job.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA, preferably with an update process for reviewed upgrades.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:199
zizmor reported unpinned-uses
Minor caution · high confidence
The build uses a moving version of an external automation component. A future change could alter what runs during the build.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An external action is referenced by a mutable version tag. This weakens CI reproducibility and permits tag movement, without evidence here of exploitation.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to a reviewed immutable commit SHA.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:129
zizmor reported unpinned-uses
Minor caution · high confidence
The release workflow uses a moving version label for a third-party action, so a later upstream change could alter the build.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned action reference in a release job permits upstream tag movement or compromise to change code executed with release workflow privileges.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:316
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow follows a movable upload-action version, allowing future upstream changes to influence release handling.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The upload action is tag-pinned rather than SHA-pinned. This weakens supply-chain reproducibility, but the evidence does not indicate malicious behavior or artifact tampering.
Impact: medium · Exploitability: plausible
Developer action: Pin the artifact upload action to a full commit SHA and review the selected commit before updating it.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:287
zizmor reported unpinned-uses
Minor caution · high confidence
The release workflow uses a moving version label for a publishing action, so a later upstream change could affect released images.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned container publishing action executes with package-write and attestation-related privileges, creating supply-chain exposure if the referenced tag changes.
Impact: high · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:337
zizmor reported unpinned-uses
Minor caution · high confidence
The release job downloads a third-party build component by a moving version label. A changed or compromised label could affect release verification or builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action in the Windows verification job uses a major-version reference instead of an immutable commit, permitting upstream reference movement.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and document the corresponding version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:96
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads an external automation component by a movable version label. If that label were changed maliciously, the release job could run altered code with permission to publish packages.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The release workflow uses an unpinned third-party action reference. The job has package-write permission and receives the repository token, so action compromise could affect published container tags. The supplied context shows no malicious behavior, but mutable references weaken supply-chain integrity and reproducibility.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a full commit SHA and update it deliberately when upgrading.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release-latest.yml:52
zizmor reported unpinned-uses
Minor caution · high confidence
The build uses an action version that can move over time, so the build environment may change without a workflow edit.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The setup action is referenced by a mutable version tag. This creates a supply-chain and reproducibility weakness, but no harmful payload or compromise is demonstrated.
Impact: medium · Exploitability: plausible
Developer action: Pin the setup action to a full commit SHA and review the selected commit before updating it.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:250
zizmor reported artipacked
Minor caution · low confidence
The release workflow uploads a build file. The supplied evidence does not show that secrets are included, but accidental inclusion could expose sensitive data to artifact readers.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The candidate concerns persistence of workflow-produced files as a GitHub Actions artifact. The shown path is a generated release archive, and no secret-bearing input or attacker-controlled artifact composition is demonstrated. The issue is therefore a defensive packaging concern rather than evidence of credential theft.
Impact: medium · Exploitability: unlikely
Developer action: Review artifact contents and ensure secrets or credential-bearing files cannot enter the uploaded release artifact; restrict artifact contents explicitly.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:129-131
zizmor reported cache-poisoning
Minor caution · low confidence
A build cache may reuse files from another run. The supplied excerpt does not show enough cache details to determine whether an attacker could replace executable build inputs.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: The scanner flags possible cache poisoning at an action reference, but the excerpt does not include cache setup or restore keys. No poisoned artifact, attacker-controlled key, or execution path from cache contents is demonstrated.
Impact: medium · Exploitability: unlikely
Developer action: Review cache configuration and avoid restoring shared caches for executable runtime artifacts unless cache keys are immutable and scoped to trusted revisions.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release.yml:219
zizmor reported unpinned-uses
Minor caution · high confidence
The release-signing step uses a movable action version, so its behavior could change upstream.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The provenance action is tag-pinned rather than immutable. This affects build reproducibility and trust in the release pipeline, but the supplied evidence shows no forged attestation or malicious update.
Impact: medium · Exploitability: plausible
Developer action: Pin the provenance-attestation action to a full commit SHA and review the selected commit before updating it.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:270
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that a CI artifact could preserve credentials, but the supplied material does not show the artifact contents or even the relevant workflow step.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The metadata reports an artipacked match at a removed line, but no workflow excerpt or artifact path is supplied. The project comments state that build artifacts are intentionally not uploaded, so the evidence is insufficient to establish credential persistence.
Impact: medium · Exploitability: unlikely
Developer action: Inspect the omitted workflow lines and ensure no credentials or sensitive files are included in uploaded artifacts; avoid artifact upload unless required.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:70
zizmor reported unpinned-uses
Minor caution · high confidence
The release workflow uses a moving version label for a third-party action, so a later upstream change could alter the build.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned action reference in the release workflow allows tag changes or upstream compromise to modify build behavior.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:292
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads code identified only by a version tag. If that tag were changed or compromised, a release build could run altered code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is referenced by a mutable major-version tag in a release workflow. A compromised or retargeted action could execute with release-job permissions, although the supplied evidence does not establish such compromise.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced checkout action to an immutable commit SHA and document the maintained action version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:132
zizmor reported template-injection
Minor caution · low confidence
A scanner thinks a value inserted into a build command might be interpreted as instructions, but the actual command is not shown.
Technical evidence
Scanner reason: zizmor matched workflow-security rule template-injection in this repository.
Contextual assessment: The candidate identifies template expansion, but the relevant line is omitted. Exploitability depends on whether the expanded value is attacker-controlled and reaches a shell or other interpreter.
Impact: medium · Exploitability: plausible
Developer action: Inspect the omitted command and avoid placing attacker-controlled workflow expressions in shell code; pass values through environment variables and validate them.
- Scanner
- zizmor 1.28.0
- Rule
- template-injection
- File role
- tooling
- Source
- .github/workflows/release.yml:286
zizmor reported cache-poisoning
Minor caution · low confidence
A build job may reuse files saved by earlier runs. The supplied material does not show that an attacker can place harmful files in that cache, but cache reuse can become risky if trust boundaries change.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: The scanner flags possible cache poisoning at the setup step. The supplied context shows dependency installation and build execution but omits cache declarations and branch or event permissions, so exploitability and runtime impact are not demonstrated.
Impact: medium · Exploitability: unlikely
Developer action: Review cache configuration and avoid restoring cached runtime or build artifacts across trust boundaries; use immutable, scope-limited cache keys where caching is necessary.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release.yml:132
zizmor reported cache-poisoning
Minor caution · low confidence
The scanner suspects that build files could be mixed between workflow runs, but the supplied excerpt does not show enough cache configuration to determine whether that can happen.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: Only a low-confidence cache-poisoning finding is supplied. The relevant cache key, restore behavior, trust boundaries, and event triggers are absent, so exploitability and impact cannot be established.
Impact: medium · Exploitability: plausible
Developer action: Provide the complete workflow around the cache use and confirm whether untrusted branches or pull requests can populate or consume the cache; otherwise no change is warranted based on this evidence.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release.yml:99
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving action version, so a future upstream change could alter what runs in CI.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The cited workflow step references an external action by a version tag rather than an immutable commit. This permits tag movement or upstream compromise to change CI behavior, although the supplied evidence does not show malicious behavior or exposed credentials.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a full commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:59
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that files containing temporary credentials might be included in a build artifact. The supplied excerpt does not show whether that actually happens.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked rule matched near packaging and artifact-upload operations, but workflow excerpts and file-generation details are incomplete. No credential source, artifact listing, or external disclosure path is demonstrated.
Impact: medium · Exploitability: plausible
Developer action: Review the full job and artifact contents; prevent secrets from entering packaged files or uploaded artifacts, and use explicit secret-scrubbing checks.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:198
zizmor reported cache-poisoning
Minor caution · low confidence
A build cache might reuse files from another workflow run. More information is needed to know whether those files can affect the release.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: The scanner reports cache-poisoning potential, but the supplied lines do not show the cache definition, key construction, trust boundary, or restored files. The finding therefore supports hardening rather than a confirmed vulnerability.
Impact: medium · Exploitability: unlikely
Developer action: Review cache configuration and constrain cache scope to trusted revisions; do not restore executable runtime artifacts from mutable or cross-branch caches.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release.yml:205
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build artifact using a changeable third-party action reference. A future upstream change could affect the test environment.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The action reference is mutable, creating avoidable CI supply-chain exposure. Its shown purpose is to retrieve the package built by an earlier job; no malicious payload is evidenced.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA, preferably with an update process for reviewed upgrades.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:198
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that a temporary credential could persist in the uploaded package artifact, but the provided material cannot confirm that.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked match is adjacent to artifact creation and upload. Without the omitted workflow statements and generated file manifest, credential persistence and actual exposure remain unproven.
Impact: medium · Exploitability: plausible
Developer action: Review the full job and artifact contents; prevent secrets from entering packaged files or uploaded artifacts, and use explicit secret-scrubbing checks.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:209
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow fetches an action using a movable version label. If that label were changed upstream, a future release could run different code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An external action is referenced by a mutable major-version tag rather than an immutable commit. This creates supply-chain drift risk in a publishing workflow with npm identity-token permission, but does not itself demonstrate compromise.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA, while retaining the existing version review process.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release-npm.yml:132
zizmor reported artipacked
Minor caution · low confidence
The workflow uploads a build archive. The available evidence does not show that it contains passwords or tokens, but the upload should be limited to the intended package.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The scanner associated artifact persistence with the packaging and upload step. Excerpts do not establish credential inclusion, artifact accessibility, or secret disclosure, so this is a review and scoping concern rather than a demonstrated vulnerability.
Impact: low · Exploitability: plausible
Developer action: Review the artifact contents and exclude credentials or sensitive runner files before upload; use narrowly scoped artifact paths.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:128
zizmor reported unpinned-uses
Minor caution · high confidence
The build uses a moving version of an external automation component, so its behavior can change without a workflow change.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The action reference is tag-based rather than commit-pinned. This is a standard CI supply-chain weakness, with no supplied evidence of malicious execution.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to a reviewed immutable commit SHA.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:163
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a release-upload component selected by a version tag. A changed tag could cause altered code to run during publishing.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The release workflow references an action by mutable major tag. Release jobs have write permissions for attestations and identity tokens, so immutable pinning is appropriate; however, no malicious action behavior is shown.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced artifact-upload action to an immutable commit SHA and document the maintained action version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:144
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build tool by movable version label, so a future upstream change could alter the code executed during builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned third-party GitHub Action. This creates a mutable dependency in CI, but the supplied metadata does not establish compromise or credential theft.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a reviewed immutable commit SHA and document the selected version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:105
Credential access and network transmission in one file
Minor caution · high confidence
This function sends debugging information to the app's own gateway and may include the mobile login token for authorization. The supplied code does not show it sending data to an unrelated outside service, but anything placed in the debug data could be written to logs and should be limited and protected.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The function POSTs JSON containing the event, caller-supplied data, and a timestamp to a gateway-relative debug logging endpoint. It conditionally places the mobile token in the Authorization header. This is consistent with the documented temporary local debug logger and does not by itself demonstrate credential exfiltration; however, caller-controlled payloads may contain secrets or user content, and the supplied evidence does not establish endpoint access controls, log retention, or whether all call sites avoid sensitive data.
Impact: medium · Exploitability: plausible
Developer action: Review every call site to ensure sensitive fields are not included in data, restrict the debug endpoint to local or authenticated access, redact credentials and personal content before logging, and remove the temporary logger when debugging is complete.
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/lib/dev-log.ts:9
zizmor reported template-injection
Minor caution · low confidence
A scanner suspects that inserted workflow data could become commands, but the supplied context does not show the data source or execution site.
Technical evidence
Scanner reason: zizmor matched workflow-security rule template-injection in this repository.
Contextual assessment: The scanner reports template injection at an omitted line. Without the expression, trigger conditions, and interpreter context, a concrete injection path cannot be established.
Impact: medium · Exploitability: plausible
Developer action: Inspect the omitted command and avoid placing attacker-controlled workflow expressions in shell code; pass values through environment variables and validate them.
- Scanner
- zizmor 1.28.0
- Rule
- template-injection
- File role
- tooling
- Source
- .github/workflows/release.yml:284
malcontent reported anti-static-xor-terms
Minor caution · low confidence
The scanner noticed obfuscated text inside a font file, but the actual file contents were not supplied. That finding alone does not show credential theft, code execution, or harmful behavior.
Technical evidence
Scanner reason: malcontent matched behavioral-analysis rule anti-static-xor-terms in this repository.
Contextual assessment: The only available evidence is metadata for a production TrueType font and a scanner report that XOR-obfuscated terms were present. Font files are ordinarily passive assets, but without raw bytes or decoded matches, the finding cannot establish whether the content is benign font data, unusual metadata, or a malicious payload. No runtime data flow, destination, execution path, or persistence behavior is shown.
Impact: low · Exploitability: unlikely
Developer action: Provide the font bytes or a trusted structural analysis of the binary, including the matched strings and any executable or network-relevant behavior, so the obfuscation finding can be evaluated.
- Scanner
- malcontent 1.25.7
- Rule
- anti-static-xor-terms
- File role
- production
- Source
- apps/web/public/fonts/JetBrainsMonoNLNerdFont-Bold.ttf
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a named version instead of a permanent code fingerprint. If that action were changed upstream, a future release could run the changed code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned third-party action reference permits mutable upstream resolution. The supplied context places it in a publishing workflow with write permissions, so supply-chain drift is a meaningful hardening issue, but the evidence does not show compromise or malicious behavior.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to an immutable commit digest and review the change through normal dependency-update procedures.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:359
JavaScript analysis reported javascript.xray.shady-link
Minor caution · high confidence
When started with its default settings, the local server listens on all network interfaces so phones and other devices can connect. Anyone who can reach that port may be able to interact with the app if the server has no additional access control; the supplied file does not show whether authentication exists.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The host selection defaults to a wildcard non-loopback bind and is forwarded to the server runtime. This is consistent with the documented mobile-access feature, but the supplied evidence does not establish authentication, authorization, firewall configuration, or endpoint exposure. The concern is network exposure, not a shady outbound link.
Impact: medium · Exploitability: plausible
Developer action: Consider documenting the network exposure and requiring explicit opt-in or authentication when binding beyond loopback.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- services/api/src/server/npm-server.ts:72
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving action version, so a future upstream change could alter what runs in CI.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The cited workflow step references an external action by a version tag rather than an immutable commit. This permits tag movement or upstream compromise to change CI behavior, although the supplied evidence does not show malicious behavior or exposed credentials.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a full commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:58
zizmor reported unpinned-uses
Minor caution · high confidence
Another release action is selected by a movable version label, allowing its behavior to change without a repository change.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The setup action is not immutable-pinned. Because the job can publish packages using trusted publishing, upstream tag replacement could affect release integrity.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and update it deliberately through review.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release-npm.yml:128
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving version label for a checkout action, so a later upstream change could alter what runs in CI.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned action reference. The supplied workflow context shows a build-only CI job with no evidence of secret use or publication; this is supply-chain exposure but not evidence of malicious behavior or immediate compromise.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review dependabot or equivalent updates.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:209
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build tool by movable version label, so a future upstream change could alter the code executed during builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned third-party GitHub Action in a build job. Mutable action resolution increases supply-chain risk without, on this evidence, proving harmful execution.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a reviewed immutable commit SHA and document the selected version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:94
zizmor reported unpinned-uses
Minor caution · high confidence
The job downloads repository contents through a movable action label, so an upstream change could alter what code is checked out or executed.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is referenced by a mutable major tag in a package-release workflow. This is a supply-chain hardening gap; the supplied evidence does not show exploitation.
Impact: medium · Exploitability: plausible
Developer action: Pin the checkout action to an immutable commit SHA.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release-npm.yml:79
zizmor reported artipacked
Minor caution · low confidence
A scanner flagged a possible chance that sensitive workflow files could be included in an uploaded build artifact, but the supplied excerpt does not show that happening.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The metadata indicates an artifact-persistence pattern near an artifact upload, but the removed workflow excerpts do not establish that credentials or other sensitive files enter the uploaded paths.
Impact: medium · Exploitability: unlikely
Developer action: Ensure only intended build outputs are archived and inspect artifact contents before publication.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:316-318
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that a CI artifact could preserve credentials, but the supplied material does not show the artifact contents or even the relevant workflow step.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The metadata reports an artipacked match at a removed line, but no workflow excerpt or artifact path is supplied. The project comments state that build artifacts are intentionally not uploaded, so the evidence is insufficient to establish credential persistence.
Impact: medium · Exploitability: unlikely
Developer action: Inspect the omitted workflow lines and ensure no credentials or sensitive files are included in uploaded artifacts; avoid artifact upload unless required.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:58
zizmor reported unpinned-uses
Minor caution · high confidence
The build relies on an external action whose tag can move, allowing an unexpected version to run later.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow uses a mutable action tag. This affects integrity and reproducibility of CI, but the supplied evidence does not show attacker control or impact beyond the build environment.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to a reviewed immutable commit SHA.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:148
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build tool by movable version label, so a future upstream change could alter the code executed during builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned third-party GitHub Action in an artifact-building job. This is a hardening issue; the supplied context does not show secret use or exfiltration.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a reviewed immutable commit SHA and document the selected version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:93
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects a build artifact could retain credentials, but the available excerpt does not show any secret being placed into an artifact.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The finding is low-confidence and the relevant lines are omitted. Although the workflow handles signing secrets and uploads release artifacts, the supplied context does not demonstrate secret inclusion, exposure, or attacker access.
Impact: medium · Exploitability: plausible
Developer action: Inspect the omitted artifact and credential-handling steps; prevent secrets from being written into uploaded artifacts and restrict artifact contents and retention.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:267-269
zizmor reported unpinned-uses
Minor caution · high confidence
The build uses a moving version of an external automation component. Pinning it makes the build behavior predictable.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The external action is not immutable-pinned. This permits upstream tag changes to affect CI, but no malicious behavior is demonstrated in the supplied context.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to a reviewed immutable commit SHA.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:128
zizmor reported unpinned-uses
Minor caution · high confidence
The release workflow uses a moving version label for a third-party action, so a later upstream change could alter the build.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned action reference in a release job permits upstream tag movement or compromise to change code executed with release workflow privileges.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:319
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow invokes a third-party action through a moving label instead of a fixed revision, which weakens repeatability and supply-chain protection.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner reports an unpinned action reference in CI. This permits upstream tag movement but does not itself establish malicious execution or current compromise.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA, preferably with an update process for reviewed upgrades.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:178
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that files containing build credentials might be preserved in CI artifacts, but the supplied excerpt does not show what is uploaded.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked finding is low-confidence metadata only: the relevant artifact-upload behavior and file selection are absent. It cannot establish credential persistence or disclosure from the supplied evidence.
Impact: medium · Exploitability: plausible
Developer action: Inspect the complete job and artifact configuration, exclude credentials and sensitive workspace files from artifacts, and restrict artifact retention and access.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:93
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving action version, so a future upstream change could alter what runs in CI.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The cited workflow step references an external action by a version tag rather than an immutable commit. This permits tag movement or upstream compromise to change CI behavior, although the supplied evidence does not show malicious behavior or exposed credentials.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a full commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:82
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that a CI artifact could preserve credentials, but the supplied material does not show the artifact contents or even the relevant workflow step.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The metadata reports an artipacked match at a removed line, but no workflow excerpt or artifact path is supplied. The project comments state that build artifacts are intentionally not uploaded, so the evidence is insufficient to establish credential persistence.
Impact: medium · Exploitability: unlikely
Developer action: Inspect the omitted workflow lines and ensure no credentials or sensitive files are included in uploaded artifacts; avoid artifact upload unless required.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:82
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a movable version label when uploading release files. A changed upstream label could make the build use unexpected code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The upload action is referenced by a version tag rather than an immutable digest. This creates supply-chain exposure if the tag or its referenced action code changes, but no malicious behavior is shown.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced upload-artifact action to an immutable commit digest and review all other workflow action references similarly.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:247
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that files containing login information might be saved as downloadable build artifacts. The excerpt does not show that credentials are actually included.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The candidate identifies possible credential persistence through artifacts, but the supplied context only shows an upload of a release archive and omits its contents and any download or publication permissions. Credential exposure is therefore unconfirmed.
Impact: medium · Exploitability: plausible
Developer action: Inspect the complete artifact upload and download flow, exclude credential-bearing files from artifacts, and restrict artifact access and retention if credentials could be included.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:110-112
zizmor reported unpinned-uses
Minor caution · high confidence
The build uses a dependency setup component selected by a movable version label. If the label changes unexpectedly, the build could execute different code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The setup action is invoked by a mutable major-version tag in a release job. This creates supply-chain exposure because third-party action code executes before packaging, but the evidence does not show compromise or attacker control.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced setup action to an immutable commit SHA and document the maintained action version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:129
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving action version, so a future upstream change could alter what runs in CI.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The cited workflow step references an external action by a version tag rather than an immutable commit. This permits tag movement or upstream compromise to change CI behavior, although the supplied evidence does not show malicious behavior or exposed credentials.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a full commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:70
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build tool by movable version label, so a future upstream change could alter the code executed during builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned third-party GitHub Action in CI. This weakens dependency integrity and reproducibility, but no malicious behavior is demonstrated.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a reviewed immutable commit SHA and document the selected version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:104
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving version label for the container build setup action, allowing upstream changes to affect CI.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned container setup action. The supplied context shows ordinary local image-build preparation and no registry login or push, limiting demonstrated impact.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review dependabot or equivalent updates.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:210
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads an external automation component by a movable version label. If that label were changed maliciously, the release job could run altered code with permission to publish packages.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The release workflow uses a second unpinned third-party action reference. Its execution occurs during release promotion and the job has package-write permission plus a GitHub token, making action substitution a meaningful but indirect supply-chain risk.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a full commit SHA and update it deliberately when upgrading.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release-latest.yml:51
zizmor reported unpinned-uses
Minor caution · high confidence
This release action is selected by a movable version label rather than a permanent fingerprint, so its future code could change without a workflow edit.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The action reference is not immutable. It runs in the release job, which has repository write permission; pinning would reduce third-party action supply-chain exposure. No evidence indicates current abuse.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to an immutable commit digest and review the change through normal dependency-update procedures.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:375
zizmor reported unpinned-uses
Minor caution · high confidence
The build downloads a helper action using a movable version label. If the upstream label changes, the release could use different build behavior.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The Gradle setup action is tag-pinned but not commit-pinned. Because it runs in a release job handling signing-related environment values, immutable pinning is appropriate; the evidence does not establish compromise or secret disclosure.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced Gradle setup action to an immutable commit digest and review all other workflow action references similarly.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:205
zizmor reported unpinned-uses
Minor caution · high confidence
The build depends on a moving external action, which could change between workflow runs.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The action reference uses a mutable tag. This is a CI dependency-integrity weakness, not evidence of a compromised project.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to a reviewed immutable commit SHA.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:149
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow checks out source with a changeable action label. If the upstream label changes, CI may run different code later.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The finding concerns mutable action resolution in a privileged CI runner. The available context shows normal source checkout and does not show malicious update behavior.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA, preferably with an update process for reviewed upgrades.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:179
zizmor reported unpinned-uses
Minor caution · high confidence
The release workflow uses a moving version label for a third-party action, so a later upstream change could alter the build.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned action reference in a release job permits upstream tag movement or compromise to change code executed with release workflow privileges.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:298
zizmor reported artipacked
Minor caution · low confidence
The scanner flags a possible credential being retained in a CI artifact, but the supplied excerpt is insufficient to verify the data flow.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The low-confidence artipacked result is associated with a job that checks out source and builds a container. The omitted workflow and build details prevent confirmation of credential inclusion or artifact accessibility.
Impact: medium · Exploitability: plausible
Developer action: Review the full job and artifact contents; prevent secrets from entering packaged files or uploaded artifacts, and use explicit secret-scrubbing checks.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:178
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow uses a moving version label for the Docker build action, so an upstream change could modify CI behavior.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned Docker build action. The shown configuration disables pushing and only loads a locally built image, so the evidence supports a hardening issue rather than an immediate high-impact vulnerability.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review dependabot or equivalent updates.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:212
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that files containing build credentials might be preserved in CI artifacts, but the supplied excerpt does not show what is uploaded.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artipacked finding is low-confidence metadata only. Artifact upload steps, paths, and credential-bearing files are not supplied, so actual exposure cannot be confirmed.
Impact: medium · Exploitability: plausible
Developer action: Inspect the complete job and artifact configuration, exclude credentials and sensitive workspace files from artifacts, and restrict artifact retention and access.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:104
zizmor reported unpinned-uses
Minor caution · high confidence
The release job uses a third-party setup component through a moving version label. A compromised update could change what code runs during builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The setup action is referenced by a major-version tag rather than an immutable commit. This is a release-pipeline supply-chain weakness, not evidence of malicious behavior.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and document the corresponding version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:110
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow obtains Java through a movable version label. A changed upstream action could alter the release build.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The Java setup action is referenced by a mutable tag in a release workflow. This is a supply-chain hardening issue, not evidence that the action currently performs malicious activity.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced Java setup action to an immutable commit digest and review all other workflow action references similarly.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:215
zizmor reported unpinned-uses
Minor caution · high confidence
A release verification step relies on an action identified by a moving version label. If the upstream label changes, the verification environment could change unexpectedly.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The setup action used by the Linux verification job is not pinned to a commit SHA. Mutable action references permit upstream changes to enter the workflow.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and document the corresponding version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:99
zizmor reported artipacked
Minor caution · low confidence
The workflow collects build files and publishes them. If an earlier build step accidentally included a secret, this step could make it available in the release, although the supplied evidence does not show that happening.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The scanner reports possible credential persistence through artifact handling. Supplied context shows broad artifact download followed by release publication, but does not reveal artifact contents, producers, or any credential-bearing file, so actual exposure is unproven.
Impact: medium · Exploitability: plausible
Developer action: Ensure downloaded artifacts are restricted to trusted workflow outputs, use least-privilege permissions, and avoid publishing sensitive files or credentials as release assets.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:359-361
zizmor reported unpinned-uses
Minor caution · high confidence
The artifact-download action is selected by a movable version label. A future upstream change could alter what code runs during publishing.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The action reference is mutable and executes in a job with repository write permission. This is a supply-chain hardening concern; the supplied evidence does not establish exploitation.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to an immutable commit digest and review the change through normal dependency-update procedures.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:363
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that an uploaded build package could keep sensitive information around. The supplied excerpt does not establish that sensitive information is present.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artifact-related finding covers the Windows verification path, but the supplied lines show only the workflow region and not the artifact contents, permissions, or downstream retrieval. The suspected persistence is unconfirmed.
Impact: medium · Exploitability: plausible
Developer action: Inspect the complete workflow and ensure credentials cannot enter uploaded artifacts; apply least-privilege artifact access and short retention where appropriate.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:96-98
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow checks out code using a movable version label. If the upstream label changes, the release process could execute unexpected helper code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The checkout action is not pinned to an immutable digest. The excerpt shows checkout of a specified repository revision, which limits source drift, but does not eliminate action supply-chain risk.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced checkout action to an immutable commit digest and review all other workflow action references similarly.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:161
zizmor reported cache-poisoning
Minor caution · low confidence
The build may reuse saved files. The supplied excerpt does not show harmful cache contents or a path for an attacker to create them, but release builds should avoid unsafe reuse.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: The scanner flags potential cache poisoning around the Linux build setup. Cache declarations, key construction, and workflow triggers are absent from the supplied context, so the candidate cannot be elevated beyond a precautionary weakness.
Impact: medium · Exploitability: unlikely
Developer action: Review cache configuration and isolate caches by trusted revision and event source; do not restore untrusted runtime artifacts into release jobs.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release.yml:113
zizmor reported unpinned-uses
Minor caution · high confidence
The release process runs an attestation component selected by a movable version label. A compromised label could alter release-time behavior.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The attestation action is referenced by a mutable major tag and runs in a job granted identity-token and attestation permissions. Immutable pinning reduces supply-chain risk; the evidence does not indicate malicious behavior.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced build-attestation action to an immutable commit SHA and document the maintained action version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:141
zizmor reported artipacked
Minor caution · low confidence
A packaged file is retained as a CI artifact. The supplied evidence does not prove it contains secrets, but its contents should be checked.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The scanner flagged possible credential persistence around artifact handling. The provided excerpt shows a tarball upload but does not establish that credentials are included or exposed.
Impact: low · Exploitability: plausible
Developer action: Review the artifact contents and exclude credentials or sensitive runner files before upload; use narrowly scoped artifact paths.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/ci.yml:148
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow downloads a build tool by movable version label, so a future upstream change could alter the code executed during builds.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The scanner identifies an unpinned third-party GitHub Action. The evidence supports supply-chain hardening, not a conclusion of malicious execution.
Impact: medium · Exploitability: plausible
Developer action: Pin the action to a reviewed immutable commit SHA and document the selected version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/ci.yml:83
zizmor reported artipacked
Minor caution · low confidence
The scanner suspects that release files might preserve credentials, but the available excerpt does not show any credential-bearing file or actual exposure.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: The artifact-persistence candidate concerns the initial release build and upload region. The visible context shows an archive upload with limited retention, but not archive contents or whether secrets can be included; this supports review rather than a confirmed vulnerability.
Impact: medium · Exploitability: plausible
Developer action: Inspect the complete workflow and ensure credentials cannot enter uploaded artifacts; apply least-privilege artifact access and short retention where appropriate.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release.yml:57-59
zizmor reported unpinned-uses
Minor caution · high confidence
The checkout action is selected by a movable version label rather than a permanent fingerprint, leaving the workflow exposed to upstream action changes.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The action reference is unpinned. It checks out the release source in a workflow that later publishes artifacts, making immutable pinning appropriate, while no malicious behavior is shown.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced action to an immutable commit digest and review the change through normal dependency-update procedures.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:345
zizmor reported unpinned-uses
Minor caution · high confidence
The workflow checks out source using a version label rather than an exact immutable revision. If the label is retargeted, a release build could use unexpected code.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The Windows verification job uses a mutable checkout action tag. It runs tests rather than publishing, limiting direct impact, but immutable action references are still advisable for reproducible workflow behavior.
Impact: medium · Exploitability: plausible
Developer action: Pin the referenced checkout action to an immutable commit SHA and document the maintained action version.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:113
zizmor reported unpinned-uses
Minor caution · high confidence
The release workflow uses a moving version label for an image-publishing action, so a later upstream change could affect released software.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: An unpinned action reference executes in a job with package publication and provenance-related privileges, increasing supply-chain impact if the tag is redirected.
Impact: high · Exploitability: plausible
Developer action: Pin the action to an immutable commit SHA and review updates deliberately.
- Scanner
- zizmor 1.28.0
- Rule
- unpinned-uses
- File role
- tooling
- Source
- .github/workflows/release.yml:322
Expected scanner matches (60)
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
This test temporarily changes process environment values to check display-detection behavior and restores them afterward. The supplied evidence does not show data leaving the machine.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is a scanner signal for environment serialization, but the supplied source context shows test-only inspection and mutation of environment variables for graphical-session detection. No credential collection, transmission, or production execution path is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:110
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test temporarily reads an environment setting so it can restore it after testing display detection. It does not send the value anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The supplied context shows process environment variables being saved, modified, and restored in a test cleanup hook. No serialization destination, network operation, credential use, or runtime application behavior is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:88
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
The test sets a display-related environment value to confirm Linux graphical-session detection. It does not show secret theft or network activity.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The matched signal concerns environment serialization, while the visible test only assigns a fixed display identifier and asserts detection. It is test setup for platform behavior, not evidence of exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:111
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test saves a display-related setting and restores it afterward. This is normal test isolation, not credential collection.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The evidence identifies environment-variable handling in a test cleanup path. The visible context contains no outbound flow or persistence beyond restoring the test process state.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:92
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
This test uses a temporary home-directory value to check how a Linux file picker command is built. It does not send that value anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The source context shows controlled environment setup and restoration around a unit test for command arguments. The command construction is related to the documented native folder-picker functionality; no external destination or production secret handling is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:124
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
The test checks the fallback folder location when the home-directory setting is absent. This is ordinary platform testing, not credential access.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate points to environment-related test code that deletes and restores a variable, then verifies deterministic native-dialog arguments. No sensitive collection, persistence, or outbound transfer is evidenced.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:125
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This test temporarily removes graphical-session settings to check that the application reports native dialogs as unavailable. It does not send those values anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is in a test that deletes graphical environment variables, invokes the filesystem route, and asserts an unavailable response. No serialization to an external destination or credential flow is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:173
zizmor reported artipacked
Expected behavior · low confidence
The scanner suggests a possible credential-related artifact issue, but the relevant workflow lines were not included, so the actual behavior cannot be established.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: Only scanner metadata is supplied for the artifact-persistence finding. No artifact creation, file selection, retention, or credential exposure data is available.
Impact: none · Exploitability: unlikely
Developer action: Provide the omitted workflow portion and inspect artifact upload steps, especially whether credentials or workspace contents are archived.
- Scanner
- zizmor 1.28.0
- Rule
- artipacked
- File role
- tooling
- Source
- .github/workflows/release-npm.yml:79-83
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test temporarily saves a desktop environment setting so it can restore it after testing. It does not send that information anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The supplied test context reads and restores DISPLAY around Linux dialog tests. The evidence shows local test-state management only, with no serialization destination, network operation, or credential access.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:138
zizmor reported superfluous-actions
Expected behavior · high confidence
The flagged release action performs the release step that the workflow needs; the scanner notes that this capability is already available in the runner, but this is not a security problem.
Technical evidence
Scanner reason: zizmor matched workflow-security rule superfluous-actions in this repository.
Contextual assessment: The candidate is an informational superfluous-actions finding. The supplied workflow context shows a conventional release action used to create a draft release and attach generated assets; no harmful data flow or concealed execution is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- zizmor 1.28.0
- Rule
- superfluous-actions
- File role
- tooling
- Source
- .github/workflows/release.yml:375
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This match is in a test file that checks release metadata and archive selection. It does not show the application changing startup settings or installing persistence.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The supplied source is a Bun test fixture and assertions for parsing release data, selecting platform archives, and checksum assets. The reported line is an expectation about parsed release notes; no startup-modification API, filesystem persistence operation, or execution path is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- test
- Source
- services/api/test/updater-release.test.ts:60
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
The test restores a temporary environment setting after checking file-picker behavior. Nothing in the supplied evidence indicates it exposes user information.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: This is a cleanup branch in a test surrounding controlled environment manipulation. Its role is to avoid contaminating later tests; the evidence does not show runtime credential use or transmission.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:131
malcontent reported anti-static-xor-terms
Expected behavior · low confidence
The scan found obfuscated text in a font file, but no file contents were provided. A font shipped as a production asset does not by itself show harmful activity.
Technical evidence
Scanner reason: malcontent matched behavioral-analysis rule anti-static-xor-terms in this repository.
Contextual assessment: The artifact is a production TrueType font and only metadata is available. The scanner reports XOR-obfuscated terms, but supplies no matched strings, offsets, executable behavior, loading path, or network and persistence data. This evidence cannot establish malicious capability or a vulnerability, and the font's role is consistent with the documented frontend application purpose.
Impact: none · Exploitability: unlikely
Developer action: Provide the font bytes or an extracted, independently reviewable representation so the matched terms and their behavior can be assessed.
- Scanner
- malcontent 1.25.7
- Rule
- anti-static-xor-terms
- File role
- production
- Source
- apps/web/public/fonts/JetBrainsMonoNLNerdFont-Regular.ttf
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This signal corresponds to reading a named setting from the process environment so the local server can be configured. It is not shown collecting or sending credentials.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cited line reads a project-specific environment variable to determine the listening host, with a local default. No serialization, disclosure destination, or credential transmission is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- services/api/src/server/prod-server.ts:50
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test changes a display setting temporarily to check behavior, then puts it back. No secret is transmitted or stored.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is in a test that manipulates process environment state for display-detection cases. The supplied evidence does not show environment serialization to an external sink.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:93
Credential access and network transmission in one file
Expected behavior · high confidence
The app gets its configured mobile access token and uses it to authenticate a chat request to the app's gateway. This is the normal way for a local AI client to protect its own API calls.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The token is obtained through the client authentication helper, then conditionally placed in the Authorization header for a POST to the gateway base URL combined with the application endpoint. The request body is the intended chat payload, and no separate or concealed destination is shown. The supplied evidence does not indicate credential harvesting or exfiltration beyond the authenticated gateway request expected by the project purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/stream.ts:37
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
This match is in a test helper that creates sample release-download information. It does not itself download, run, or persist anything.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The supplied context shows a test helper constructing representative asset metadata, including a release-download address, for updater parsing tests. This is inert test data and does not demonstrate startup persistence modification or malicious update behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- test
- Source
- services/api/test/updater-release.test.ts:30
OpenGrep reported tavernkeeper.persistence.startup-modification
Expected behavior · high confidence
The supplied file is a tokenizer data file containing vocabulary and configuration data. The evidence does not show startup actions, executable behavior, persistence, or changes to the host system.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification in this repository.
Contextual assessment: The supplied source is structured tokenizer metadata and vocabulary data in a production asset. The scanner match provides no supporting source excerpt, and the visible artifact contains no demonstrated execution, filesystem modification, process launch, or startup-registration behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.persistence.startup-modification
- File role
- production
- Source
- services/api/assets/tokenizers/claude.json:1
Bidirectional text control detected in source
Expected behavior · high confidence
The flagged character is part of a large tokenizer vocabulary, where unusual Unicode characters are expected data rather than hidden instructions.
Technical evidence
Scanner reason: A bidirectional Unicode control character was detected in a source file.
Contextual assessment: The evidence places the bidirectional control in a JSON tokenizer vocabulary mapping a character to a token ID. It is data consumed by tokenization, not executable source or an ordering-sensitive script, and no downstream execution or concealment behavior is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- unicode-bidi-control
- File role
- production
- Source
- services/api/assets/tokenizers/mistral.json:30716
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This is test cleanup that restores a display-related setting. It does not indicate theft of passwords or API keys.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The evidence places the signal in an afterEach restoration branch for process environment variables. No attacker-controlled forwarding, network destination, or durable persistence is evidenced.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:98
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This reads a local environment setting to choose where application data is stored. The supplied code does not show it leaving the machine.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cited line resolves a project-specific data-directory environment variable, defaulting beneath the configured project root. It is path configuration, not environment serialization or exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- services/api/src/server/prod-server.ts:34
JavaScript analysis reported javascript.xray.data-exfiltration
Expected behavior · high confidence
The flagged text is a test that creates a temporary database directory and checks provider settings. It does not send credentials or other data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration in this repository.
Contextual assessment: The supplied source is a Bun test importing temporary-directory, filesystem, path, domain constants, and database-store modules. Its operations create a temporary database, create and update a provider record using a documented provider endpoint, retrieve it, and duplicate it. No network request, credential access, persistence outside the temporary test directory, obfuscation, or exfiltration destination is shown. The scanner signal appears to be a false positive from static analysis of ordinary test literals.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.data-exfiltration
- File role
- test
- Source
- packages/db/test/provider-coauthor-transport.test.ts:3
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The flagged line only reads an optional setting that lets the user choose which network address the local server listens on. It does not send that value or other environment data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The process reads one named environment variable and falls back to a fixed bind address before passing the resulting host value to the local server runtime. The supplied code shows no serialization of the environment, credential access, or external transmission. The non-loopback default is disclosed as supporting mobile access.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- services/api/src/server/npm-server.ts:72
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test checks and restores a desktop environment setting used to decide whether a graphical dialog is available. It is not an attempt to collect credentials.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cited line restores DISPLAY after each test. In this test-only file, the operation is bounded cleanup of process-local environment state and has no shown external destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:160
Credential access and network transmission in one file
Expected behavior · high confidence
The code obtains the app's local access token and sends it to the configured gateway while uploading or selecting a character avatar. This is the expected authorization flow for these character-management requests, not evidence of sending credentials to an unrelated destination.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The token is retrieved through the client authentication helper, then conditionally placed in an Authorization header on POST requests to the gateway base URL for avatar operations. The supplied evidence shows no separate destination, concealment, persistence, or unrelated credential handling; the request purpose and endpoint match the documented character and gallery functionality.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/character-api.ts:160
Credential access and network transmission in one file
Expected behavior · medium confidence
This code sends diagnostic event data to the app's configured gateway. It may include a mobile access token for authorization, but the shown destination is the project's own debug endpoint and the snippet does not show theft or transmission to an unrelated service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The function obtains a mobile token through the application's client helper and conditionally places it in a Bearer authorization header for a POST to the gateway base URL's debug logging route. The request body contains the caller-supplied event data and a timestamp. In the supplied context, this is consistent with authenticated client-side debug logging; there is no evidence of a third-party destination, obfuscation, persistence, or credential harvesting. Because the payload fields and server-side handling are not shown, inadvertent sensitive-data logging remains a limited concern.
Impact: low · Exploitability: unlikely
Developer action: Document the debug endpoint's purpose and retention, ensure payloads exclude provider credentials and sensitive prompt data, and consider redacting or minimizing diagnostic fields before transmission.
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/chat-api.ts:740
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test records the original display setting so it can restore the user's test environment. That is ordinary testing behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate concerns reading an environment variable at test setup. The surrounding code uses the value for restoration and does not demonstrate disclosure or credential handling.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:87
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test records a display-related setting before changing it, then uses the saved value for cleanup. Nothing in the supplied evidence transmits it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The test stores the original WAYLAND_DISPLAY value for restoration in afterEach. This is ordinary isolation for environment-dependent tests, not environment serialization for exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:153
Credential access and network transmission in one file
Expected behavior · high confidence
This function uploads a file to the application's configured gateway and includes the app's login token so the gateway can authorize the upload. The evidence does not show the token being sent to an unrelated destination or used outside this upload request.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The function obtains the configured gateway base URL, obtains the mobile token, and sends the selected file via a POST upload request to that gateway with a Bearer authorization header. This credential access and network transmission are directly coupled to the documented asset-upload functionality; no alternate destination, concealment, persistence, or unrelated credential use is shown in the supplied source.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/asset-api.ts:8
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test saves the original display setting before testing a graphical file picker and restores it afterward. This is test cleanup.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cited assignment captures process.env.DISPLAY within a test fixture. The surrounding context shows restoration in afterEach and no persistence or outbound data flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:144
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This page checks the local server to see whether it is ready, then reloads the page when it is. The other script only reads a saved theme and animates the logo; it does not download or run outside code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The cited region contains a same-origin health check using fetch('/health') and a reload on an HTTP-success response, plus localStorage theme retrieval, DOM styling, SVG animation, and requestAnimationFrame. No fetched response is evaluated, injected into the DOM, passed to a command executor, or otherwise used as executable code. The scanner correlation does not establish a download-to-execution flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- services/api/src/server/loading-placeholder.ts:147-193
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged pattern is a fixed command-matching expression used to recognize dice commands. It does not access credentials, send data elsewhere, or execute arbitrary input.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The expression matches a bounded dice-command grammar using numeric alternatives and optional whitespace, modifiers, and mode words. It is applied to the latest message and has no nested ambiguous repetition or attacker-controlled construction. The surrounding code also bounds the number of generated dice, so the scanner signal does not establish a security vulnerability or malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- apps/web/src/components/build/editors/script-templates/dice.js:17
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
The test temporarily sets a display value to simulate a graphical Linux session. This supports testing and does not demonstrate secret theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The visible context uses a fixed environment value and asserts display detection. The signal is located in a test file and lacks evidence of serialization to an external recipient or execution outside the test.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:104
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged value is a configurable local network address for the server to listen on, which matches a local roleplay application's network-access feature.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The cited expression selects a bind host from a project-specific environment variable and defaults to all interfaces. This affects local server reachability; no outbound link or data transfer is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- services/api/src/server/prod-server.ts:49
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
The test removes a display setting to simulate a headless system, then checks the expected result. It does not show any information being collected or sent.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is associated with test-only environment manipulation for headless detection. The supplied evidence shows no outbound sink, secret access, persistence, or concealed execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:105
Credential access and network transmission in one file
Expected behavior · high confidence
The app retrieves a locally stored mobile access token and sends it to the configured local gateway while bootstrapping the application. This is consistent with authenticated local and mobile access, not evidence of sending credentials to an unrelated service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The token is obtained through the client token helper and used in a request to the configured gateway bootstrap endpoint, both as an authorization header and through the token-query helper. The supplied code shows no unrelated destination, hidden collection, persistence, or obfuscation; the project purpose explicitly includes local runtime and mobile network access.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/settings-api.ts:20
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test sets a fake display value to verify Linux display detection. It is a local, temporary test input.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The supplied context shows assignment of a synthetic display environment value before invoking a predicate. There is no external sink or persistence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:99
zizmor reported cache-poisoning
Expected behavior · low confidence
The scanner reports a possible cache problem, but the supplied lines only identify an action and do not show how caching is configured or used.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: The evidence is insufficient to determine cache scope, key derivation, restore behavior, or attacker influence over cache contents.
Impact: none · Exploitability: unlikely
Developer action: Provide the omitted surrounding workflow and confirm cache configuration, key inputs, branch protections, and whether untrusted builds can populate the same cache.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release-npm.yml:132
JavaScript analysis reported javascript.xray.data-exfiltration
Expected behavior · low confidence
The signal is in a test file that creates temporary database data and checks provider transport settings. The supplied evidence does not show secret collection, external transmission, or hidden execution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.data-exfiltration
- File role
- test
- Source
- services/api/test/provider-profile-transport.test.ts:3
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This converts a user-configurable local port number into the server's listening configuration. It does not expose a secret by itself.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The supplied server bootstrap passes a numeric port derived from a project-specific environment variable, with a documented default, to the runtime. No external destination or sensitive payload is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- services/api/src/server/prod-server.ts:36
Credential access and network transmission in one file
Expected behavior · high confidence
The file sends a login token only to the app's configured local gateway while exporting or importing personas. This is needed to perform authenticated persona operations and is not shown being sent to an unrelated service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/persona-api.ts:125
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test saves a display setting so it can be restored after the test. It does not expose or upload the setting.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The line reads DISPLAY as setup state for integration-test cleanup. Its role and surrounding restoration logic are consistent with deterministic testing; no attacker-controlled sink or external destination is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:137
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The app intentionally runs user-defined dice scripts, so executing JavaScript is part of the advertised game-system feature. The supplied code shows a sandbox with a timeout and limited dice registration and rolling interfaces.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: Dynamic execution occurs in the dice-script discovery path through Node's VM API. The supplied context indicates execution in a constructed sandbox, blocks rolling during discovery, exposes only application-provided globals and dice operations, and applies a timeout. No network, filesystem, credential, or process access is shown in the supplied evidence. The excerpt does not establish complete sandbox robustness, but this candidate alone does not indicate a vulnerability or malicious behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- services/api/src/domain/scripts-engine/dice-script-sandbox.ts:164-167
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test restores the display setting that existed before it ran. This prevents one test from affecting another.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cited cleanup branch writes the previously captured DISPLAY value back to process.env. It is local state restoration in a test file, without evidence of credential handling or transmission.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:152
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test restores a display setting after running. This prevents one test from affecting another.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is associated with environment-state cleanup in a test file. The evidence does not show serialization, exfiltration, execution, or application startup behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:94
Credential access and network transmission in one file
Expected behavior · high confidence
This function sends a requested gallery-image action to the app's configured backend. It includes the mobile access token only when one exists, and the code does not send it to an unrelated destination.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The apparent credential source and network sink are an authenticated API request implementing the documented server-side gallery-asset promotion flow. The destination is constructed from the application's gateway base URL, the request is POST-only, and the token is used as a bearer credential for that same application endpoint. The supplied evidence shows no third-party destination, unsolicited execution, persistence, logging, or credential harvesting.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/lib/attach-from-gallery.ts:29
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This test restores a graphical-session setting after testing filesystem dialog behavior. It is normal test cleanup, not data theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is an environment-variable restoration operation in test teardown. The supplied context shows local mutation and cleanup only, with no outbound destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:163
Credential access and network transmission in one file
Expected behavior · medium confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/skill-api.ts:66
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This test restores another graphical-session setting after the test finishes. Nothing indicates that the value leaves the test process.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is teardown logic restoring or deleting a process environment variable. It is confined to test-state management and has no shown network, persistence, or credential-handling path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:162
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The application intentionally runs user-authored dice and roleplay scripts, and the README describes JavaScript scripts as a feature. The shown code runs them in a time-limited isolated context with a restricted, read-only actor and attempt context and a bounded dice interface.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The dynamic execution is a documented script-engine capability. The supplied code invokes the script and orchestration together inside a Node VM context with a timeout, exposes frozen snapshots for sensitive contextual data, and limits randomness to the injected bounded roller. The excerpt does not show filesystem, network, credential, or host-process handles being exposed. The evidence does not establish complete VM isolation against all possible sandbox escapes, but the scanner match itself is expected for this feature.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- services/api/src/domain/scripts-engine/dice-script-sandbox.ts:254-257
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test restores the saved display setting after checking behavior without a graphical session. It only changes the test process environment.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cleanup assignment restores DISPLAY from a value captured before the test suite. The supplied context indicates bounded test teardown and no persistence beyond the process.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:145
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · medium confidence
The test restores or removes a temporary home-directory setting after checking a folder-picker fallback. This is normal test cleanup.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The source context shows restoration of process environment state in a finally block. It is limited to a test fixture and provides no evidence of credential exfiltration or harmful runtime behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:132
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This passes the configured server address into the normal server startup routine. The evidence shows configuration, not secret collection or theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cited startup argument forwards the previously selected bind host to the local production runtime. The supplied context contains no serialization of the environment and no outbound transmission.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- production
- Source
- services/api/src/server/prod-server.ts:49
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test restores the saved Wayland display setting after each test. This is normal cleanup and does not indicate data theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The cited cleanup branch writes the captured WAYLAND_DISPLAY value back to the process environment. The evidence shows no serialization sink, network destination, or secret-related use.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:161
JavaScript analysis reported javascript.xray.data-exfiltration
Expected behavior · high confidence
This tooling script creates local mock character and chat data for visual tests. The flagged security signal corresponds to ordinary temporary-directory and file-generation behavior, not credential collection or data transmission.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration in this repository.
Contextual assessment: The supplied source imports local filesystem, temporary-directory, path, and argument utilities; selects a caller-provided or temporary output directory; creates test-data subdirectories; and writes synthetic JSON and chat fixtures. No network client, credential access, process execution, or external destination is shown. The embedded image data is a static test fixture. The scanner metadata alone does not establish exfiltration, and the visible data flow is consistent with the file's tooling role and stated smoke-test purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.data-exfiltration
- File role
- tooling
- Source
- scripts/bench/generate-small-mock.ts:4
Credential access and network transmission in one file
Expected behavior · high confidence
The code gets the app's existing login token and sends it to the app's own backend when opening the native folder picker. This is needed so the request works for authenticated desktop and mobile sessions; the supplied evidence does not show the token being sent to an unrelated service.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The function retrieves the mobile/session token through the client module, conditionally places it in an Authorization header, and POSTs to the configured gateway's native-dialog endpoint. This matches the documented purpose of manually reproducing the client's authenticated request and provides no evidence of third-party transmission, persistence, concealment, or unrelated credential use.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- tavernkeeper 4
- Rule
- credential-exfiltration
- File role
- production
- Source
- apps/web/src/api/import-api.ts:127
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
This test removes a graphical-session setting to verify behavior when no desktop display is available. It is a local test setup step.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The candidate is a test fixture mutation of a process environment variable before exercising the filesystem route. The supplied evidence shows no serialization to an external service or access to provider credentials.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:172
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test temporarily changes a display-related environment value and restores it. Nothing here shows secrets leaving the machine.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: The signal occurs in a test cleanup operation handling process environment variables. No destination, timing outside tests, or data flow to an external service is supplied.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- services/api/test/fs-native-dialog.test.ts:91
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The application runs user-configured roleplay scripts in a restricted execution environment, with a five-second limit and only selected data and standard utilities exposed. The supplied evidence does not show access to credentials, files, networking, or hidden execution.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched operation executes script.code through Node's VM context with an explicitly constructed sandbox containing application contexts, utility values, standard language built-ins, and a console stub. A five-second timeout is applied, errors are captured, and successful state changes are persisted as part of the documented scripting feature. The excerpt does not establish a sandbox escape or exposure of sensitive host capabilities.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- services/api/src/domain/scripts-engine/script-sandbox.ts:208-211
zizmor reported cache-poisoning
Expected behavior · low confidence
The scanner reports a possible cache problem, but the supplied lines do not reveal the cache behavior needed to judge it.
Technical evidence
Scanner reason: zizmor matched workflow-security rule cache-poisoning in this repository.
Contextual assessment: Only a cache-poisoning scanner label and a line reference are available; runtime artifact creation and cache trust boundaries are absent.
Impact: none · Exploitability: unlikely
Developer action: Provide the omitted surrounding workflow and confirm cache configuration, key inputs, branch protections, and whether untrusted builds can populate the same cache.
- Scanner
- zizmor 1.28.0
- Rule
- cache-poisoning
- File role
- tooling
- Source
- .github/workflows/release-npm.yml:128