No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material7 low
What this review found
No material or immediate-danger item was identified.
Expected scanner matches (7)
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a test that checks whether the extension properly hides secrets in error messages. The flagged text uses fake placeholder values and a reserved test domain to confirm the redaction works correctly. There is no real password or API key here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is inside a test file and constructs a synthetic Error object whose message contains placeholder markers such as REDACTED_SECRET and a reserved example.invalid domain. The surrounding assertions verify that the diagnostic formatter redacts Authorization headers, api_key parameters, and URL key parameters. These are test fixtures designed to exercise secret-redaction logic, not real credentials. No credential is exposed or transmitted.
This is a test that copies a piece of the extension's own code and runs it in isolation with fake data to check that old settings are cleaned up correctly. It only uses code and data from the project itself, with no outside input, so it poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file. The test reads the project's own `index.js` source, slices out the `getSettings` function body, and executes it via `new Function` with fully controlled mock arguments (a fake settings store, no-op migration helpers, a counter callback). No untrusted or external input reaches the dynamic execution. The purpose is to unit-test internal settings-migration logic that is not exported from the production module. There is no network access, credential handling, persistence, or obfuscation involved.
This is a test file that extracts a piece of the extension's own code and runs it in isolation to check that the tracker window sizing math works correctly. It only uses the project's own source code, not anything from outside, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file (file) that reads source from the project's own index.js via fs.readFileSync, slices a known function body, and executes it in an isolated scope to verify tracker widget layout math. The code being dynamically executed is the project's own committed source, not external or user-controlled input. This is a standard test-harness pattern for testing non-exported functions.
This is a test that pulls the tracker settings migration code from the extension's own source file and runs it to make sure it works. Since it only uses the project's own code, there is no security concern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file that slices the `migrateTrackerWidgetSettings` function body from the project's own index.js and executes it to verify settings migration logic. The dynamically executed code originates entirely from the project's committed source with no external or user-controlled input. This is a standard testing pattern for non-exported functions.
This is a test that checks whether the extension properly hides secret-looking values in error messages. The flagged text is fake data used only to prove the redaction works. There is no real password or key exposed here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is inside a test file and constructs a synthetic error message containing placeholder tokens already marked as redacted (e.g., [REDACTED_SECRET:...]) alongside fake-looking key strings. The surrounding assertions verify that the diagnostic formatting functions strip or redact these tokens from output, confirming the project's secret-redaction behavior works. No real credential is present; the values are test fixtures designed to exercise redaction logic.
This is a test that extracts the item-name formatting code from the extension's own source and runs it to verify it works correctly. It only uses the project's own code, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file that slices the `formatTrackerItemDisplayName` function body from the project's own index.js and executes it with a trivial inline sanitizer callback. The dynamically executed code is the project's own committed source, not external or user-controlled input. This is a standard testing pattern for non-exported functions.
This is another test that extracts helper functions from the extension's own code and runs them with fake data to verify that per-profile settings work correctly. It uses only the project's own code and mock data, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a second `new Function` call in the same test file. It slices a helper-function region from the project's own `index.js` source and executes it with controlled mock dependencies (mock profile lookups, mock route resolvers, imported format constants). The test verifies per-profile thinking-disable format resolution behavior. No untrusted input, network calls, credential access, or persistence is involved. The dynamically executed code originates solely from the project's own committed source.