TavernKeeper Scan Report

vevan/arousalPub

Commit d4bd404 Reviewed Sep 2, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 65 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (55)

Dependency advisory GHSA-3m5p-2c4r-xxw2:pkg:3295c544e7763c1467b3b71a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/verify-host-build-without-bundled.mjs:29
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches-audit.integration.test.ts:33
JavaScript analysis reported javascript.xray.short-identifiers · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches.test.ts:1
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/lance-manifest-migrate.test.ts:3
JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/ops/backup-data.mjs:122-126
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-api-settings.test.ts:13
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: web/vite.config.ts:11
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/admin/localhost.test.ts:7
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: server/scripts/spike-fts-tokenizers.mjs:7
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches-audit.integration.test.ts:4
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/ops/backup-data.mjs:21
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: web/test/conversation-chat-request-body.test.ts:7
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/terminal-link.mjs:22
Dependency advisory GHSA-jqff-g426-hqxp:pkg:9d5a0ee915070fcb3b4f0f49 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches.integration.test.ts:33
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/run-dev.mjs:47
Dependency advisory GHSA-fph4-wmhf-6fwf:pkg:02097b1c123d52488af54cbe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/chunk-chain-index-repair.integration.test.ts:33
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-chunks-unreadable.test.ts:34
Dependency advisory GHSA-5jgf-p345-68v8:pkg:0c0b4150b3480deab8a6ef16 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: server/scripts/spike-fts-tokenizers.mjs:110
JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/run-prod.mjs:85-94
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/run-dev.mjs:21
Dependency advisory GHSA-f65p-4m7j-42xc:pkg:d8eaa1be485d9c348ff3a796 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: server/scripts/spike-fts-tokenizers.mjs:51-55
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/build.mjs:12
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches-delete-memory.integration.test.ts:32
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/plugin-lorebook-ensure.test.ts:10
JavaScript analysis reported javascript.xray.short-identifiers · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: web/test/utils/composer-slash.test.ts:1
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/chunk-chain-index-repair.integration.test.ts:4
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches-delete-memory.integration.test.ts:30
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/dev-config.mjs:35
JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: web/scripts/build-analyze.mjs:8-12
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/sync-all-shared.mjs:11
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/run-server-test-sandbox.mjs:13
JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/build-meta.mjs:15-18
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches-delete-memory.integration.test.ts:4
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches.integration.test.ts:31
JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/run-prod.mjs:84-93
JavaScript analysis reported javascript.xray.unsafe-stmt · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/generate-api-error-codes.mjs:9-11
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/regex-rules-file.test.ts:13
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: web/scripts/build-analyze.mjs:5
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/chunk-chain-index-repair.integration.test.ts:31
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval · opengrep 1.26.0

This technical signal is not part of the shipped runtime behavior.

Policy reason: owned-inert-tooling · Execution scope: tooling-only

Source: scripts/generate-api-error-codes.mjs:9-11
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches.integration.test.ts:4
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/plugin-dist.mjs:85
JavaScript analysis reported javascript.xray.encoded-literal · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-api-settings.test.ts:20
JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/client-ip.test.ts:11
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/watch-plugins.mjs:129
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-chunks-unreadable.test.ts:32
JavaScript analysis reported javascript.xray.serialize-environment · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-branches-audit.integration.test.ts:31
Dependency advisory GHSA-w2qp-rph6-63g4:pkg:df0d988a34d87e958d33fd6d applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

Source: scripts/check-git-eol.mjs:10-13
JavaScript analysis reported javascript.xray.data-exfiltration · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: server/test/conversation-chunks-unreadable.test.ts:4

Contextual expected matches (9)

JavaScript analysis reported javascript.xray.encoded-literal

Expected behavior · high confidence

The flagged text is just a made-up conversation ID used in a test file. It is a normal test fixture, not a hidden secret or obfuscated code.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.

Contextual assessment: The flagged literal is a simple test fixture constant CONV_ID set to the string value on line 12. This is an integration test file that creates a temporary conversation index and verifies error handling for missing chunk files. The constant is a hardcoded test identifier, not an encoded secret, credential, or obfuscated payload.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.encoded-literal
File role: production
Source: server/src/integration/conversation-chunks-unreadable-integration.ts:12

Credential access and network transmission in one file

Expected behavior · high confidence

The flagged line is a Docker health check that pings the app's own local health endpoint to see if it is running. It reads the port number from an environment variable and makes a local-only request. No secrets are read or sent anywhere.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: Dockerfile:47

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · medium confidence

The code runs regex operations in a sandboxed environment with a time limit to prevent a malicious or poorly-written regex from freezing the app. The code that runs is fixed by the application, not controllable by users, so this is not a code injection risk.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The runInNewContext call executes a fixed, static script string that constructs a RegExp from passed parameters and calls text.replace. User-controlled values (pattern, flags, text, replacement) are passed as context data variables, not interpolated into the script string, so there is no arbitrary code injection path. The purpose is to enforce a 250ms timeout on regex execution to prevent ReDoS denial of service, which is a security improvement. While node:vm is not a true security sandbox, it is not being used for isolation here but for its timeout capability, and the executed code is entirely application-controlled.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: production
Source: server/src/regex-exec-timeout.ts:26-33

Credential access and network transmission in one file

Expected behavior · high confidence

The file saves user settings and sends embedding API key information only to the app's own server, which is the intended design. It deliberately avoids storing raw API keys in the browser. There is no indication of keys being sent to any outside location.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: This preferences store manages embedding API configuration and patches it via fetch to the same-origin relative path /api/user-preferences. The persistEmbeddingLocal function explicitly removes any plaintext API key from localStorage and stores only an apiKeyId reference. The buildEmbeddingServerPatch sends a plaintext apiKey to the app's own backend only when the user has entered a new key and no apiKeyId exists yet, which is the normal key-submission flow. This matches the README's stated design that keys stay on the server and the browser UI never holds plaintext keys. All network calls are same-origin with no external or dynamic destinations and no obfuscation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: web/src/stores/preferences.ts:705

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · medium confidence

The flagged patterns are standard parts of common JavaScript libraries (Handlebars template engine and source maps) bundled into this generated file. They are normal parser rules, not a security problem.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged regexes are standard tokenizer rules from the bundled Handlebars lexer and URL-parsing utilities from the source-map library. These are well-known patterns in a generated bundle file. The regexes operate on template and source-map text during normal library operation. No attacker-controlled path to catastrophic backtracking is demonstrated, and the patterns are part of widely used, established dependencies.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: plugins/trace-keeper/dist/web.mjs:1896

Credential access and network transmission in one file

Expected behavior · high confidence

The file manages login tokens and sends them only to the app's own backend server using standard web requests. This is exactly what an authentication module is supposed to do. There is no sign of tokens being sent anywhere unexpected.

Technical evidence

Scanner reason: A credential source and an outbound network operation were detected in the same file.

Contextual assessment: This is a Pinia auth store that reads auth tokens from localStorage and sends them via fetch to same-origin relative API paths (/api/auth/status, /api/auth/refresh, /api/auth/me, /api/auth/login, /api/auth/setup, /api/auth/register, /api/auth/logout, /api/auth/device-default). The token is used as a Bearer header and the refreshToken is sent in a POST body, both to the application's own backend. There is no fetch to any external or third-party destination, no dynamic URL construction, and no obfuscation. The co-location of credential storage and network calls is inherent to any frontend auth store and matches the project's stated authentication purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: tavernkeeper 5
Rule: credential-exfiltration
File role: production
Source: web/src/stores/auth.ts:127

JavaScript analysis reported javascript.xray.prototype-pollution

Expected behavior · high confidence

The flagged code is from well-known libraries and actually protects against prototype pollution rather than causing it. The references to __proto__ are part of built-in safety checks, not vulnerabilities.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution. The match applies to this repository.

Contextual assessment: The scanner's prototype-pollution signal was triggered by references to __proto__ in bundled third-party code. The first occurrence is Handlebars' proto-access control module, which explicitly sets propertyWhiteList['__proto__'] = false on an object created via Object.create(null) to block prototype-chain access during template rendering. The second occurrence is the source-map library's supportsNullProto feature detection, also using Object.create(null). Both are defensive patterns that mitigate or detect prototype access, not pollution sinks. No attacker-controlled data flows into these assignments.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.prototype-pollution
File role: generated
Source: plugins/trace-keeper/dist/web.mjs:589

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The build script checks an environment variable to decide whether to run tests after building. This is normal build-tool behavior and does not read or transmit any secrets.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The JS-X-Ray serialize-environment signal was triggered by process.env access at line 41. The code checks process.env.PLUGIN_WATCH to decide whether to skip running tests after an esbuild bundle step. This is a build-time script, not shipped runtime code. It reads a single build-configuration flag with no credential or sensitive value, and there is no network transmission or persistence of environment data.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: production
Source: plugins/trace-keeper/build.mjs:41

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The code reads a single setting from the environment to know which plugin to load. This is normal configuration, not credential theft. The file actually strengthens security by blocking direct network access from plugins.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The flagged line reads a single environment variable PLUGIN_WORKER_ENTRY_PATH to determine which plugin module to load in the sandboxed worker subprocess. This is a configuration mechanism set by the host process, not serialization or exfiltration of environment variables. The file also implements security hardening: it denies raw network access by replacing fetch and WebSocket, routes all API calls through IPC to the host, and supports Node permission-based filesystem restrictions. Reading one configuration variable for plugin entry path discovery is proportional and expected for a plugin sandbox bootstrap.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: production
Source: server/src/plugin-system/plugin-worker-bootstrap.mjs:105

Related contextual observations

Bundled Handlebars lexer rules and source-map utilities

low risk · medium confidence

These regexes come from popular third-party libraries included in the bundle. They look complex because parser generators produce them automatically, but they are standard and expected.

Technical assessment

The lexer.rules array and URL regex constants originate from the Handlebars parser generator output and the source-map library, both standard npm dependencies. The complex patterns are characteristic of generated lexers and URL parsers, not hand-crafted obfuscation or ReDoS vectors.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

plugins/trace-keeper/dist/web.mjs:1896

Coverage and limitations

Inventory: 1098 files · 11457688 bytes
Contextual coverage: 64 of 64 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 802 files · 4464773 bytes
X-Ray review families: 84 warning occurrences compacted to 53 evidence-preserving review families
Representations: 802 raw · 36 decoded · 2 normalized · 0 bundle modules
Stage scans: 802 raw signatures · 136 raw AST · 802 raw OpenGrep · 38 derived signatures · 2 derived AST · 38 derived OpenGrep

Unresolved JavaScript stages

plugins/conversation-export/src/web/index.ts — raw-ast / parse
plugins/guidance-generate/dist/web.mjs — derived-ast / parse
plugins/guidance-generate/dist/web.mjs — normalize / parse
plugins/guidance-generate/src/server/index.ts — raw-ast / parse
plugins/guidance-generate/src/web/index.ts — raw-ast / parse
plugins/guidance-generate/test/server/injection.test.ts — raw-ast / parse
plugins/plot-summary/src/auto-summarize-companion.ts — raw-ast / parse
plugins/plot-summary/src/auto-summarize-progress.ts — raw-ast / parse
plugins/plot-summary/src/batch-write.ts — raw-ast / parse
plugins/plot-summary/src/dialogs.ts — raw-ast / parse
plugins/plot-summary/src/errors.ts — raw-ast / parse
plugins/plot-summary/src/index.ts — raw-ast / parse
plugins/plot-summary/src/lifecycle.ts — raw-ast / parse
plugins/plot-summary/src/notify-outcome.ts — raw-ast / parse
plugins/plot-summary/src/parse-plot-slash.ts — raw-ast / parse
plugins/plot-summary/src/pipeline.ts — raw-ast / parse
plugins/plot-summary/src/plot-slash.ts — raw-ast / parse
plugins/plot-summary/src/prepare-context.ts — raw-ast / parse
plugins/plot-summary/src/prompt-preview.ts — raw-ast / parse
plugins/plot-summary/src/range-picker.ts — raw-ast / parse
plugins/plot-summary/src/review.ts — raw-ast / parse
plugins/plot-summary/src/server/complete-context-hooks.ts — raw-ast / parse
plugins/plot-summary/src/settings.ts — raw-ast / parse
plugins/plot-summary/src/shared/entry-sort.ts — raw-ast / parse
plugins/plot-summary/src/shared/lorebook-sort.ts — raw-ast / parse
plugins/plot-summary/src/shared/plot-summary-context-blocks.ts — raw-ast / parse
plugins/plot-summary/src/shared/prepare-context-blocks.ts — raw-ast / parse
plugins/plot-summary/src/shared/range-limits.ts — raw-ast / parse
plugins/plot-summary/src/shared/summarize.ts — raw-ast / parse
plugins/plot-summary/src/shared/summary-group-placement.ts — raw-ast / parse
plugins/plot-summary/src/shared/summary-prompt-layout.ts — raw-ast / parse
plugins/plot-summary/src/shared/task-notify-label.ts — raw-ast / parse
plugins/plot-summary/src/shared/utils.ts — raw-ast / parse
plugins/plot-summary/src/sidecar.ts — raw-ast / parse
plugins/plot-summary/src/state.ts — raw-ast / parse
plugins/plot-summary/src/types.ts — raw-ast / parse
plugins/plot-summary/test/complete-draft.test.ts — raw-ast / parse
plugins/plot-summary/test/errors.test.ts — raw-ast / parse
plugins/plot-summary/test/plot-summary-context-blocks.test.ts — raw-ast / parse
plugins/plot-summary/test/settings.test.ts — raw-ast / parse
plugins/plot-summary/test/task-notify-label.test.ts — raw-ast / parse
plugins/swipe-cleaner/src/web/index.ts — raw-ast / parse
plugins/trace-keeper/dist/server.mjs — derived-ast / parse
plugins/trace-keeper/dist/server.mjs — normalize / parse
plugins/trace-keeper/dist/web.mjs — derived-ast / parse
plugins/trace-keeper/dist/web.mjs — normalize / parse
plugins/trace-keeper/src/audit-debug.ts — raw-ast / parse
plugins/trace-keeper/src/bundle-resolve.ts — raw-ast / parse
plugins/trace-keeper/src/constants.ts — raw-ast / parse
plugins/trace-keeper/src/host-segment-snapshot.ts — raw-ast / parse
plugins/trace-keeper/src/index.ts — raw-ast / parse
plugins/trace-keeper/src/panel-empty.ts — raw-ast / parse
plugins/trace-keeper/src/panel-render.ts — raw-ast / parse
plugins/trace-keeper/src/parse-block.ts — raw-ast / parse
plugins/trace-keeper/src/patch-state-client.ts — raw-ast / parse
plugins/trace-keeper/src/prepare-context.ts — raw-ast / parse
plugins/trace-keeper/src/separate-debug.ts — raw-ast / parse
plugins/trace-keeper/src/separate-dialogue.ts — raw-ast / parse
plugins/trace-keeper/src/separate-regenerate-client.ts — raw-ast / parse
plugins/trace-keeper/src/separate-turn-settings.ts — raw-ast / parse
plugins/trace-keeper/src/server/complete-context-hooks.ts — raw-ast / parse
plugins/trace-keeper/src/server/index.ts — raw-ast / parse
plugins/trace-keeper/src/server/patch-state.ts — raw-ast / parse
plugins/trace-keeper/src/server/separate-regenerate.ts — raw-ast / parse
plugins/trace-keeper/src/shared/separate-prompt-layout.ts — raw-ast / parse
plugins/trace-keeper/src/shared/trace-keeper-context-blocks.ts — raw-ast / parse
plugins/trace-keeper/src/state.ts — raw-ast / parse
plugins/trace-keeper/src/trace-state-resolve.ts — raw-ast / parse
plugins/trace-keeper/src/tracker-prompt.ts — raw-ast / parse
plugins/trace-keeper/src/turn-view-segment.ts — raw-ast / parse
plugins/trace-keeper/src/types.ts — raw-ast / parse
plugins/trace-keeper/test/host-segment-snapshot.test.ts — raw-ast / parse
plugins/trace-keeper/test/panel-empty.test.ts — raw-ast / parse
plugins/trace-keeper/test/segment-action-flow.test.ts — raw-ast / parse
plugins/trace-keeper/test/separate-dialogue.test.ts — raw-ast / parse
plugins/trace-keeper/test/server/injection.test.ts — raw-ast / parse
plugins/trace-keeper/test/sidebar-segment-e2e.test.ts — raw-ast / parse
plugins/trace-keeper/test/trace-state-resolve.test.ts — raw-ast / parse
plugins/trace-keeper/test/tracker-prompt.test.ts — raw-ast / parse
server/scripts/import-st-preset.ts — raw-ast / parse
server/src/admin/console-url.ts — raw-ast / parse
server/src/admin/rotate-data-key.ts — raw-ast / parse
server/src/admin/routes.ts — raw-ast / parse
server/src/api-config-references.ts — raw-ast / parse
server/src/api-credential-resolve.ts — raw-ast / parse
server/src/api-error-codes.ts — raw-ast / parse
server/src/api-keys-file.ts — raw-ast / parse
server/src/api-keys-sanitize.ts — raw-ast / parse
server/src/api-preset-test.ts — raw-ast / parse
server/src/api-settings-default-seed.ts — raw-ast / parse
server/src/api-settings-file.ts — raw-ast / parse
server/src/api-settings-sanitize.ts — raw-ast / parse
server/src/assemble-prompts.ts — raw-ast / parse
server/src/asset-hybrid-fts-status.ts — raw-ast / parse
server/src/asset-hybrid-fts.ts — raw-ast / parse
server/src/auth-config.ts — raw-ast / parse
server/src/auth-password.ts — raw-ast / parse
server/src/auth-rate-limit.ts — raw-ast / parse
server/src/auth-secret.ts — raw-ast / parse
server/src/auth-sessions.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: d4bd40420f9ee99a3dc9daa957024f0550a88e5e
Completed: Sep 2, 2026
History depth: 3 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 0 fresh / 9 reused groups · 0 fresh / 9 reused candidates
Review source reports: 1b5d045cc4d09951321b2f73c5d491df3d4784486e5478f1f5a2cee238613a71
Evidence triage: 55 deterministic / 9 contextual candidates · 9 contextual / 44 total behavior cases
Model budget: 0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage: 0 input · 0 output · 0 cache read · 0 reasoning tokens
Report: e98636b57775a1edce89ea4f1b38c74b0504f494eed27a7bad0e179e9522fe5b