No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:419
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-validation.js:108
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:3931
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- scene-item-state.js:443
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:852
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- narration-sanitizer.js:67
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- prose-guard-edits.js:294
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- pre-flight.js:1238
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:183
Contextual expected matches (12)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that copies a small piece of the extension's own code and runs it with pretend inputs to check that the widget layout math works. It only runs on the developer's machine during testing, uses no outside information, and is not part of what users install.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The match is a dynamic function constructor inside a behavioral test case. The test reads the extension's own committed entry script from local disk, slices out a specific layout helper, and re-evaluates it with fixed literal constants and inert test doubles substituted for its dependencies. The evaluated string originates entirely from the repository's own source; no chat content, user input, network data, or persisted state reaches it. The extension manifest loads only the main script, so this construct never executes in the shipped SillyTavern runtime and runs only when a developer executes the test suite.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22700-22715
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A pattern-matching rule in a testing helper was flagged as potentially slow. Looking at the actual code, the pattern cannot blow up the way the scanner worries about, and it only ever runs on the project's own test data on the developer's machine. There is no way for an outsider to feed it input, and worst case is a briefly slower test run.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged expression is a path resolver inside a developer-run golden-output evaluation script. Structurally, it anchors on a fixed literal prefix, uses a negated character class that cannot overshoot its terminator, and ends with a single greedy wildcard inside an optional group, so matching is effectively linear and does not exhibit nested-quantifier catastrophic backtracking. The strings it is applied to come from the project's own committed fixtures and from capture files the operator supplies on the command line, not from chat content, network responses, or other untrusted runtime input. Even a deliberately pathological path string would only slow this local evaluation utility, which is a self-inflicted, recoverable condition with no path to credential loss, data exfiltration, or persistent harm. The scanner signal is a conservative heuristic on the wildcard segment, not a demonstrated exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-golden-evaluator.mjs:44
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test takes one of the extension's own helper functions, runs it with a fixed set of example settings, and checks the result. It is ordinary developer testing with no outside data and no effect on installed users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The match is a dynamic function constructor in a test case that extracts a display-mode normalization helper from the extension's own entry script and executes it with a small fixed constants object. The code under evaluation is repository-authored source read from local disk, the supplied arguments are literal test fixtures, and execution occurs only under the developer-run test harness. No untrusted input path, network destination, or persistence is involved, and the construct is absent from the shipped extension entry point named in the manifest.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22671-22674
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test runs one of the extension's own small number-checking helpers with a few example numbers to verify it behaves correctly. Nothing from outside the repository is involved, and it does not run for end users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The match is a dynamic function constructor in a test case that extracts a saved-dimension normalization helper from the extension's own committed source and executes it with literal numeric arguments followed by assertions on the results. The evaluated text is fully repository-authored, read from the local checkout, and never influenced by chat content, user configuration, or network data. It executes only when the developer test suite runs and is not loaded by the extension manifest into the SillyTavern runtime.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22675-22680
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code builds and runs code on the fly, which sounds scary, but it only does this inside the project's own test suite. The code it runs is copied from the project's own files on the developer's machine, and the tests never see anything from the internet, the chat, or the user. It only runs when the developer runs the tests, and it is not part of what loads when the extension is installed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This match is in a behavior-test harness, not the browser extension runtime; the extension manifest loads only the main front-end script, so this file does not execute during SillyTavern sessions. The dynamic function construction evaluates a settings-migration helper that is sliced out of the repository's own committed front-end source, read from disk at test time. The evaluated text therefore originates entirely from first-party code already present in the repository: no chat content, model output, network data, or user-supplied runtime values flow into it. An adversary able to alter the evaluated text would already control the repository source itself and would have no need for this indirection. The technique is a brittle but intentional way to unit-test browser-context helpers under Node, and it executes only when a developer deliberately runs the harness.
Impact: none · Exploitability: unlikely
Developer action: Review the cited evidence and confirm the intended behavior.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11979-11985
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Another instance of the test suite assembling code from the project's own files to test a display-formatting helper. Nothing from outside the repository influences what gets run, the tests only run on demand, and this code is not part of the installed extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Same test-harness pattern as the adjacent matches: a dynamically constructed function wraps an item-name formatting helper extracted from the extension's own committed source, with a small first-party text-trimming helper injected as a parameter. The evaluated body is entirely repository-controlled text read from disk during a developer-initiated test run; there is no untrusted input path, no network access, no persistence, and no involvement of the runtime extension, which loads a different entry script. The scanner flags the dynamic-evaluation capability itself, but the data flow here is first-party-only and the behavior is proportionate to the testing purpose.
Impact: none · Exploitability: unlikely
Developer action: Optionally move the formatter into an importable module to remove the need for dynamic evaluation in tests; no security change is required.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11986-11989
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that builds a small function from the project's own source files to verify that old settings get cleaned up correctly. The code being run comes from the project itself, not from users or the internet, and the test only runs during development, not when people use the extension. There is no security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The dynamic code construction occurs in a behavior test harness. The test reads the project's own committed index.js, slices out its getSettings function, and constructs a function from that first-party source to exercise settings migration with a controlled argument list and stub callbacks. The executed code is repository-authored and not derived from user input, network data, or any untrusted source at runtime. The file is a test module executed by the developer or CI, not shipped behavior that runs inside a user's SillyTavern session. No attacker-controlled path to the dynamically executed code is demonstrated, and no data flows to external destinations.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:17811-17826
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code is part of the project's own automated test script, not the extension users run. The test grabs pieces of the project's own published code and runs them in a sandbox-like way with fake browser objects so it can check that the on-screen widget sizing math works correctly. Nothing a user, chat message, or outside source provides is ever executed—only the project's own code that is already public in the repository. This is a normal, if somewhat unusual, way to test code, and it poses no danger to users of the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The dynamic-execution match is a Function constructor used inside the repository's behavioral test harness. The harness reads the project's own committed extension entry file from disk, slices out a bounded region between two named function definitions, and compiles that excerpt with injected constants and mock environment objects so it can assert on widget geometry calculations. The only strings reaching the Function constructor are slices of the repository's own committed source plus fixed identifier names; no user input, chat content, remote data, or configuration values flow into the evaluated code. The executed code is therefore first-party, developer-authored content, and the evaluation occurs only when a developer runs the test script, not during extension loading or generation. This pattern does not create an untrusted-input execution path, persistence, exfiltration, or any shipped runtime behavior, so the scanner match reflects a test-design choice rather than a demonstrated exposure. The approach does make static analysis of the test file harder and couples tests to source text layout, which is a maintainability concern rather than a security one.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22848-22863
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test suite pulls some window-layout math out of the extension's own code and runs it with pretend screen sizes to check the math. The code being run comes only from the project's own files, runs only when the developer runs the tests, and is never loaded by the installed extension, so there is nothing an outsider could influence.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This is the first of three adjacent uses of the same testing technique in the behavior harness. A function object is built from widget-layout math sliced out of the extension's own committed front-end source, with fixed numeric constants and a stubbed viewport object supplied as parameters, so pure geometry helpers can be exercised under Node without a DOM. All evaluated text is first-party repository content read from local disk at test time; the harness is invoked manually by a developer and is not referenced by the extension manifest, so it never loads in a user's SillyTavern session. No attacker-controlled data reaches the evaluated body, and the capability matches the file's evident purpose.
Impact: none · Exploitability: unlikely
Developer action: Optionally refactor the layout helpers into an importable shared module so tests avoid dynamic evaluation; this is code-quality hygiene, not a security requirement.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11969-11978
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test extracts one of the extension's own lookup helpers and feeds it fake message objects to confirm it picks the right entry. This is normal developer testing with no external data and no runtime role in the installed extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The match is a dynamic function constructor in a test case that extracts a helper for finding the latest narration handoff entry and executes it with two plain inline predicate doubles operating on synthetic message objects. The code string comes solely from the extension's own source file on disk, the arguments are hand-written test stubs, and execution is confined to the developer-run test harness. There is no untrusted-input flow, no network egress, and no presence in the shipped extension entry point.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22692-22696
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test takes the extension's own settings-upgrade helper, runs it with made-up example values, and checks the migrated result. It uses only the project's own code and fixed test data, and it never runs on a user's machine.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The match is a dynamic function constructor in a test case that extracts a settings-migration helper from the extension's own entry script and executes it with the previously tested normalizer plus fixed numeric and object literals standing in for its dependencies. All evaluated code is repository-authored and read from the local checkout; every argument is a literal test fixture. The construct runs only under the developer test suite, involves no untrusted input, network access, or persistence, and is not part of the extension entry loaded for users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22683-22691
Gitleaks reported generic-api-key
Expected behavior · high confidence
This flagged string is a fake, made-up 'password-looking' text used in a test to make sure the extension properly hides any real credentials that might appear in error messages. It is not an actual secret, is never used to log into anything, and never leaves the user's machine. The scanner flagged it because it looks like a key, but it is intentionally fake test data.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The credential-scanner match is a synthetic test fixture embedded in a behavior test. The error string deliberately mimics transport diagnostics containing credential-shaped tokens, including already-placeholderized markers, and the surrounding assertions verify that the project's diagnostic formatter redacts authorization headers, query-string keys, and similar sensitive-looking values before display. The matched value is not a real credential, is not used to authenticate anywhere, and no code path sends it to an external destination. There is no current, usable secret and no demonstrated exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- test-behavior.mjs:18941