A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
This code only checks whether a group picture is stored locally or embedded in the app before showing it in the redesigned browser screen. Nothing is sent anywhere, and no website is contacted. The security scanner mistook the way the check is written for a suspicious link.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a local validation helper that decides whether a group avatar reference is an inline data URI or a local user-file image path before it is used as a display image. It performs only string prefix comparisons against values already in host application state, runs only when the character browser view is built, makes no network request, and sends data nowhere. It mirrors the host application's own image gate and acts as an allowlist, rejecting anything that is not a local or embedded image reference. The scanner heuristic matched the path-like string literal; the actual data flow is purely local read-and-display, consistent with the project's stated UI purpose.
The scanner flagged this line because it saw text that looks like a link or web address (a short label ending in a colon). In reality, the code is just making internal labels that distinguish folder filters from tag filters when building the character browser's navigation buttons. Clicking a button selects that filter on screen. Nothing is sent anywhere, and no website or service is contacted.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a ternary that selects a short namespace prefix string used to build internal filter identifiers by combining a kind discriminator with a facet id. The resulting identifier is written to a button's data attribute and passed to an in-module selection callback; nothing leaves the page. The full supplied file shows a pure UI navigation module: it imports one local constants module, builds DOM elements, tracks which filter row is active, and reports the chosen identifier through an injected callback. There is no fetch, socket, image beacon, dynamic code loading, or external endpoint anywhere in the supplied source. The scanner's shady-link heuristic almost certainly fired on the colon inside the prefix string literals, which superficially resemble a URI scheme. This is a false positive with no network data flow, no destination, no disclosure, and no obfuscation, and the behavior matches the extension's stated character-browser purpose.
This code recognizes the extension's own internal category labels so the browser view can filter characters by tag or folder. It is purely cosmetic list filtering inside the app with no internet activity. The scanner pattern-matched a label that looks like the start of a link, but no link is used.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line is a type-and-prefix guard that recognizes internal filter identifiers for tag and folder views within the grid's own state. It only compares in-memory UI strings created by the extension itself, drives list scoping and per-view sort defaults, and involves no network call, external destination, credential access, or persistence beyond the extension's own saved settings. The scheme-like string literals triggered the scanner heuristic; the demonstrated behavior is ordinary local UI filtering consistent with the project's stated purpose.
This code creates an internal label, like a category name, so the extension can filter its own character list when you view a tag. It never contacts any website or sends information anywhere. The scanner flagged it because the label superficially resembles the beginning of a web address.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line builds an internal navigation-filter identifier by joining a fixed label prefix with a locally generated tag id, then uses that identifier to scope the in-page character grid and highlight the active filter. The resulting string exists only in the extension's in-memory UI state and element selectors; it is never fetched, parsed as a network address, or transmitted. The scanner matched a scheme-like string literal, but there is no network destination, external data flow, persistence, or obfuscation, and the behavior matches the stated purpose of a character browsing hub.