No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-validation.js:108
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- pre-flight.js:1232
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:4234
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- scene-item-state.js:443
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:854
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- prose-guard-edits.js:294
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:461
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- narration-sanitizer.js:70
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:183
Contextual expected matches (13)
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A static scanner suggested a pattern-matching expression might be slow or unsafe. The expression is simple, only runs on short fixed strings in a developer testing tool, and cannot be manipulated by anyone outside the user's own machine. There is no real problem here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regex matches report-path strings of the form relationshipEngine[name].field. Its structure contains a negated character class with a single plus quantifier and an optional trailing group with a single wildcard quantifier; there is no nested or ambiguous quantifier arrangement that produces catastrophic backtracking, and it executes against short, developer-supplied path strings in a local evaluation harness. No untrusted or attacker-controlled input reaches this expression, and the file is an offline evaluation script for golden-test captures. Even a pathological input would at worst slow a local developer tool, which is a recoverable self denial of service with low impact. The static scanner signal is a candidate locator only; the actual pattern is benign for this context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-golden-evaluator.mjs:44
Gitleaks reported generic-api-key
Expected behavior · high confidence
A secret scanner flagged a string in the project's test file that looks like an API key. It is actually a deliberately fake sample used to check that the extension hides real keys from error messages. It is not a working key and cannot be used to access anything.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The credential-pattern match is on a fabricated error-message string inside a test fixture. The string embeds placeholder token fragments and a made-up query parameter, and the surrounding assertions verify that the project's diagnostic formatter redacts bearer tokens, api_key parameters, and key query parameters before display. The values are not real credentials for any service, the domain is a reserved invalid example domain, and the fixture exists to prove redaction works. No usable secret is present, and nothing is sent anywhere.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- test-behavior.mjs:19204
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The scanner flagged dynamic code compilation. Here it is a testing technique: the tests cut helper functions out of the extension's own source file and compile them in isolation so they can be exercised with fake inputs. Nothing from users, chats, or the internet feeds into this, and the file is a developer test rather than something that runs while people use the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The flagged site is a dynamic code-compilation call inside a test harness. The compiled string is assembled from slices of the extension's own entry file, which the same test reads from the repository directory immediately beforehand, plus static parameter-name literals and test-supplied stub callbacks. No user, chat, model-output, network, or persisted-state data flows into the compiled content. The file is a named assertion-based test suite, and the manifest declares a different file as the extension's runtime entry, so this code is not on the path executed for end users. Even when run, it compiles repository-local text in-process with no external destination, persistence, or privilege effect.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22543-22547
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This flag points at the same test-harness trick: pulling a helper function out of the extension's own code and compiling it so tests can check its behavior. Only the project's own file content goes in, there is no outside data involved, and this test code does not run during normal extension use.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This match is the same dynamic-compilation pattern as the other flagged sites in this test file: a helper routine's text is sliced from the extension's own committed source and compiled with static parameter names so the test can call it directly. The input to the compiler is entirely repository-local text read moments earlier by the same test; no external or untrusted input reaches the sink. The suite runs only when a developer executes it, and the manifest's runtime entry point is a different file, so no end-user execution path is shown.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22526-22531
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file for the project's own developer checks. It takes pieces of the project's own code (the math that positions and resizes on-screen tracker panels) and runs them in isolation to verify the numbers come out right. The code it runs comes from the project's own files, not from anything a user, chat message, or outside party provides. This kind of testing shortcut is ordinary and does not affect people who install the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The flagged dynamic-execution construct appears in a standalone behavior-test script that reads the project's own bundled extension source from local disk, slices out pure widget-geometry functions by well-known function boundaries, and evaluates them via a function constructor with injected constant arguments and a mocked DOM object. The evaluated code is entirely first-party source committed to the repository; there is no user input, network data, chat content, or other attacker-controlled content on the evaluated path. The construct exists to unit-test UI layout math that cannot be imported directly from the browser-targeted bundle, which is a common test-harness pattern. Nothing in the supplied evidence shows this file being loaded by the shipped browser extension, whose entry point is declared elsewhere in the manifest. No execution of untrusted code, no external destination, no persistence, and no obfuscation are demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22699-22714
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code builds a function on the fly so a test can run a piece of the project's own code in isolation. Everything it executes comes from the project's own files, and the test inputs are hardcoded examples. This is a normal testing technique, not hidden or dangerous behavior.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate flags a dynamically constructed function used by the test suite to exercise tracker widget settings migration logic. The test reads the project's own committed main script from disk, extracts the migration function's source by string slicing, and re-evaluates it with fixed default constants so the migration can be invoked with hand-built settings objects. The code being evaluated originates exclusively from the project's own repository files, not from user input, chat content, network data, or any untrusted source. The arguments passed in are literal test fixtures. Dynamic evaluation of one's own source in a test harness is a recognized testing technique, not concealed execution; the capability is proportionate to the testing purpose and creates no additional attack surface beyond already trusting the shipped source itself.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:12015-12021
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is the same pattern as the other flags: the tests compile a layout helper taken from the extension's own source, with made-up example values, to verify it positions a widget correctly. Only the project's own code and test data are involved, and this does not execute when people use the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The flagged range compiles widget-layout helper text extracted from the extension's own source file, injecting numeric constants and small stub functions defined inline in the test. The compiled content derives only from repository-committed text plus test literals; no attacker-controlled data path reaches the compiler call. The file is an assertion-based test suite and is not the manifest-declared runtime entry, so the capability does not execute in the shipped extension's normal operation for users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22551-22566
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The scanner flagged the tests compiling a small helper taken from the extension's own source file so its behavior can be checked with fixed example values. Only the project's own code is involved, no outside data enters, and this test code does not run during normal use of the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The first flagged compilation site builds a mode-normalization helper from text sliced out of the extension's own entry file, passing a fixed set of label constants as a parameter. The dynamic input is fully repository-local, read by the same test immediately before compilation. There is no untrusted data flow, no external destination, and no persistence, and the test file is not the manifest-declared runtime entry, so no user-facing execution path is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22522-22525
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code assembles one of the project's own formatting functions inside a test so it can be checked with fixed example inputs. Nothing from outside the project's own code is ever executed this way, so there is no security concern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate flags a dynamically constructed function that re-evaluates the project's own item display-name formatter, extracted from the project's main script, with a small stubbed helper supplied as an argument. The evaluated source is sliced from the repository's own committed file, and the only inputs are literal test values. No untrusted, remote, or user-controlled content flows into the evaluated string, and the result is used solely for assertion checks in the test suite. The pattern is visible, documented by its use, and proportionate to the testing purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:12022-12025
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a self-test that temporarily assembles a piece of the extension's own code to check that old settings are cleaned up correctly. It runs only the developer's own committed code with fake placeholder data, sends nothing anywhere, and does not affect users of the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The matched dynamic execution is a call to the Function constructor inside a local behavioral test file. The test reads the project's own committed source file, slices out the settings-migration function by known string markers, and compiles it with stubbed dependencies to assert that retired settings keys are removed and that settings saving occurs exactly once. The evaluated code is the project's own source, the inputs are fixed literal stubs defined in the test, there is no network access, no untrusted input reaching the compiled code, and no persistence or runtime effect on the shipped extension. This is a standard, if unusual, unit-testing technique for testing an embedded function without exporting it.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:18060-18075
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate flags a dynamically constructed function that re-evaluates the project's own widget layout clamp functions, extracted from the project's main script, together with fixed dimension constants and a substituted window-size object so the geometry math can be tested without a browser. The evaluated code comes only from the repository's own files, the inputs are literal viewport dimensions, and the results feed assertions. There is no untrusted input path, no external data flow, and no concealed execution; the dynamic evaluation exists solely to make layout math unit-testable in a plain script environment.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:12005-12014
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged a string that looks like an API key. Looking at the code, it is a fake, made-up credential used in a self-test that checks the tool correctly hides real-looking secrets from error messages. No actual secret is present or used.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks match at line 19021 is inside a test suite that verifies the project's own diagnostic redaction. The matched line constructs a synthetic Error message containing deliberately credential-shaped placeholder strings, then passes it through the project's diagnostic annotator and formatter and asserts that Authorization headers, api_key parameters, and query-string keys are replaced with a redaction marker before output. The surrounding assertions reference the placeholder token names only to confirm they do not appear in the formatted diagnostic. This is a fixture of fake, non-functional credential-shaped strings exercising a defensive redaction feature, not a live secret. There is no data flow to any external destination, no runtime use of the matched values as authentication, and no demonstrated exposure of a usable credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- test-behavior.mjs:19021
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The tests compile a settings-upgrade helper taken from the extension's own source, together with example values, to confirm old saved settings are converted correctly. Only the project's own code feeds this, nothing is sent anywhere, and this test does not execute when someone uses the extension normally.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This site compiles a settings-migration helper from text sliced out of the extension's own source, injecting the previously compiled normalization helper and fixed numeric defaults as parameters. The data chain is: read the project's own committed file, slice known function bodies, compile, then assert outcomes. No network, user, model, or storage input reaches the compiler, there is no external destination, and the manifest assigns runtime execution to a different entry file, so the flagged capability is confined to developer-run tests.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:22534-22542