No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:3584
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
The code has a pattern-matching line (regex) that could be slow if someone sends a specially crafted input. This could cause the evaluation tool to hang, but it's not a security threat because the tool is not used during normal chat and the problem can be fixed by restarting.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The regex `/^relationshipEngine\[([^\]]+)\](?:\.(.*))?$/` at line 44 of `file` is used to parse user-supplied report paths. While not a severe ReDoS pattern, a crafted input with many bracket-like characters could cause excessive backtracking due to the combination of a negated character class with `+` and a trailing `.*`. However, the function is only invoked during semantic golden evaluation, which is a development/test utility, not part of the core extension runtime. The attacker would need to control the `captures` input to this function, and the impact is limited to denial of service of the evaluator process, which is recoverable. No concrete exploit is demonstrated.
Impact: low · Exploitability: plausible
Developer action: Consider anchoring the regex more tightly by removing the trailing `(?:.*)` or using a non-backtracking approach. Alternatively, validate input length or syntax before matching. For a test-only utility, the risk is low, but hardening is recommended.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-golden-evaluator.mjs:44
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-validation.js:108
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- prose-guard-edits.js:292
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- pre-flight.js:1194
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- narration-sanitizer.js:67
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:345
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:183
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:3855
Contextual expected matches (12)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string. This is a common pattern for testing internal functions without exporting them.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:19838-19846
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test file uses JavaScript's built-in function creator to build small test functions from the project's own code. This is a normal testing technique and does not expose users to any security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate identifies a dynamic function construction using new Function in a test file. The source string passed to the constructor is extracted from the project's own index.js by slicing between known function boundaries, not from any untrusted input. The resulting function is used to test widget layout logic in a controlled test harness. No attacker-controlled data enters the evaluated code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11192-11198
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This new Function invocation is part of the same test file (file). It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:20003-20018
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is just a test that builds a temporary function from part of the extension's own code to check that internal settings work correctly. It's not a security issue.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The candidate matches a `new Function(...)` call inside a unit test (file) that constructs a dynamic function from a sliced string of production source code. This is a standard testing technique to access internal module functions without exporting them. The source string is derived from the project's own index.js, not from user or external input. No remote code execution or credential access is possible via this test-only path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:16333-16341
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:19826-19829
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate matches another new Function call in the same test file. It constructs a migration function from a source slice extracted from the project's own index.js. The input to the function constructor is hardcoded template strings and a slice of the project's own code. No untrusted data is used. The test verifies widget settings migration behavior without any runtime injection risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11199-11202
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:19855-19870
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:19847-19851
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension's test suite uses JavaScript's new Function to run isolated snippets of its own code during automated tests. This is a normal testing technique and does not allow any outside attacker to run arbitrary code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This new Function invocation appears in a test file. It constructs a function by concatenating a slice of the project's own source code with a return statement. The injected arguments are hardcoded test values. No attacker-controlled input reaches the dynamic code string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:19830-19835
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is just a test that builds a temporary function from part of the extension's own code to check that internal settings work correctly. It's not a security issue.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The candidate matches a `new Function(...)` call inside a unit test (file) that constructs a dynamic function from a sliced string of production source code. This is a standard testing technique to access internal module functions without exporting them. The source string is derived from the project's own index.js, not from user or external input. No remote code execution or credential access is possible via this test-only path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:16287-16302
Gitleaks reported generic-api-key
Expected behavior · high confidence
A security scanner found what looks like an API key in the testing file, but it's actually a made-up example used to check that the extension hides secrets in error messages. No real passwords or keys were exposed.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line (16918) is inside a unit test that constructs a semantic diagnostic error message containing placeholder secret-like strings (e.g., 'Authorization: Bearer [REDACTED_SECRET:b80965ff4cbf]' and 'google-sensitive-key'). These are test fixtures specifically designed to verify that the annotateSemanticDiagnosticError function redacts credentials before logging. No real API keys, secrets, or credentials are present. The error object is constructed with fake values and never transmitted anywhere. The test subsequently asserts that the redacted output does not contain the original secret strings, confirming the intended protective behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- test-behavior.mjs:16918
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate corresponds to a new Function call that creates a set of layout clamping functions from a slice of index.js. The extracted source is obtained by reading the project's own file and locating function definitions by name. The resulting function is invoked with a hardcoded globalThis mock to test position clamping logic. There is no user-controlled input or external data in the evaluated string, making this standard test behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11182-11191