No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:348
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-validation.js:108
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- scene-item-state.js:443
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:3751
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:852
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- narration-sanitizer.js:67
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- prose-guard-edits.js:294
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- pre-flight.js:1199
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:183
Contextual expected matches (12)
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A scanner flagged a regular expression as potentially unsafe, but the pattern is simple and only processes the project's own test data. There is no risk of abuse or slowdown from this code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regex at line 44 is a simple anchored pattern used to parse internal report path strings from fixture definitions. It contains no nested quantifiers or ambiguous alternation that could cause catastrophic backtracking. The input originates from project-controlled fixture data, not untrusted external sources. This is a straightforward string-parsing utility with no security implication.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-golden-evaluator.mjs:44
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code creates a function dynamically inside a test file, using only the project's own source code and controlled test values. No outside input is involved, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This candidate flags a new Function() call in a test file. The function body is assembled from slices of the project's own index.js source, read via fs.readFileSync from the local repository. The only arguments passed are controlled mock objects with numeric constants. No untrusted or external input reaches the dynamic function construction or execution. This is a legitimate test-harness technique for isolating and verifying production functions with deterministic mock environments.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11921-11927
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own code to test individual functions. The dynamic code execution flagged here only runs the project's own source with fixed test values, not anything from outside or from a user. It is a normal testing approach and poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: A test harness in file reads the project's own committed index.js via fs.readFileSync, slices the source between known function boundaries to extract the normalizeTrackerWidgetSavedDimension function body, and uses new Function to invoke it with hardcoded numeric test arguments. No untrusted or attacker-controlled input reaches the dynamic execution path; the source text is the project's own production file and the arguments are static test fixtures. This is a common pattern for unit-testing non-exported internal functions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:21681-21686
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code is in a test file that loads the extension's own source code and runs a small piece of it in isolation to check that old settings are correctly migrated. It does not execute anything from user input or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The matched `new Function(...)` call is inside a test file (file) that reads the project's own source from index.js, extracts the getSettings function body, and executes it with mock arguments to verify settings migration behavior. The dynamically constructed function body is sourced exclusively from the project's own committed source code, not from user input, network data, or any untrusted origin. No attacker-controlled data reaches this code path. This is a standard isolated-unit-test technique and does not introduce dynamic execution of untrusted code in any production or runtime path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:17701-17711
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The flagged code is part of the project's test suite. It copies small pieces of the project's own code and runs them in a controlled way with fake browser objects to check that the widget layout math works correctly. No outside or user-controlled data is involved, and nothing connects to the internet or accesses sensitive information.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The flagged `new Function` usage occurs in a test file that extracts specific function definitions from the project's own production source file by slicing source text between known function boundaries, then evaluates those slices in an isolated context with mock parameters (mock globalThis with innerWidth/innerHeight, mock document with querySelector). This is a testing pattern to verify widget geometry and layout logic without importing the full browser-dependent module. No external or untrusted input flows into the dynamic evaluation; the code being evaluated is the project's own committed source read via fs.readFileSync. The same pattern appears across multiple test cases in the expansions, all following the same extract-and-test approach with hardcoded mocks. No network access, credential handling, or exfiltration is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:21854-21869
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test loads the project's own code to check a display-mode function. Only the project's own source and fixed test values are used, with nothing coming from outside input. No security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The test harness extracts the normalizeNarratorHandoffDisplayMode function from the project's own index.js source by slicing between known function markers, then wraps it with new Function and invokes it with a hardcoded modes object. The dynamically executed body is the project's own committed source, and all arguments are static test fixtures with no external input path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:21677-21680
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Same as the previous finding: a test-only dynamic function built from the project's own code and controlled test data. No security concern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This second new Function() call follows the same pattern: it reads the project's own index.js, extracts a specific function body via string slicing, and wraps it with predefined constants to test the migrateTrackerWidgetSettings function. The only input is a controlled test object with known numeric and string values. No untrusted data flows into the dynamically constructed function.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11928-11931
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged text is a fake secret used inside a test to make sure the extension properly hides real secrets from error messages. The values are invented placeholders, not real API keys, and the test confirms they get redacted. There is no credential leak.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks match is a test fixture string inside test-behavior.mjs. The line constructs an Error object with synthetic placeholder secret-like tokens (e.g., hex strings and 'google-sensitive-key') specifically to verify that annotateSemanticDiagnosticError and formatSemanticDiagnostic correctly redact secret patterns from diagnostic output. The subsequent assertions confirm that the redacted diagnostic does not contain the placeholder values. These are fabricated test constants, not real credentials, and they are never sent to any external destination. No credential exposure exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- test-behavior.mjs:18272
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test extracts one of the project's own functions and runs it with simple fixed test inputs. No outside data is involved, so there is no security concern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The test harness extracts getLatestNarratorHandoffEntry from the project's own index.js source and invokes it via new Function with two hardcoded arrow-function stubs. The dynamically executed code is the project's own committed source, and the stub arguments are static test fixtures with no external or attacker-controlled input.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:21698-21702
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test loads the project's own settings-migration function and runs it with fixed test values. Nothing from outside the project is used, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The test harness extracts migrateNarratorHandoffSettings from the project's own index.js source and invokes it via new Function with a set of hardcoded scalar and object test arguments. The body is the project's own committed source; no untrusted or external input reaches the dynamic execution path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:21689-21697
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Same pattern as the other two findings: a test-only dynamic function built from the project's own source and controlled mock values. No security concern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: This third new Function() call constructs a test wrapper for the clampTrackerWidgetHeight/Width/Position functions extracted from the project's own index.js source. It receives a mock globalThis object with fixed numeric properties (innerWidth, innerHeight) and returns layout calculation functions for assertion. No untrusted or external input is involved in the function construction or its arguments.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11911-11920
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test extracts the project's own layout function and exercises it with fixed test inputs. All data comes from the project itself, not from any outside source, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The test harness extracts getNarratorHandoffWidgetLayout from the project's own index.js source and invokes it via new Function with a large set of hardcoded numeric, object, and arrow-function test arguments. The body is the project's own committed source; every argument is a static test fixture. No external or attacker-controlled data flows into the dynamically constructed function.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:21706-21721