No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A security scanner flagged a pattern in the extension's code that could, in theory, cause a slowdown if a specially crafted sentence was processed. However, the pattern is used to check AI model replies, and it would be very hard for anyone to make the model produce a string that actually causes a problem. Even in the worst case, the only effect would be a brief pause.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The JS-X-Ray static analysis flagged a regular expression in file (line 1243) as 'unsafe-regex', which typically indicates potential ReDoS (Regular Expression Denial of Service) risk. The regex in question is one of many in the REFUSAL_STRONG array, used to detect accidental out-of-character refusals from AI models. The regex patterns are carefully crafted with word boundaries and limited quantifiers, and the input text is generated by language models rather than attacker-controlled. No actual catastrophic backtracking has been demonstrated, and modern JavaScript engines (V8) have mitigations against most ReDoS vectors. The concrete harm would be a temporary UI freeze, not data loss or credential theft.
Impact: low · Exploitability: unlikely
Developer action: Review the regex at line 1243 for nested quantifiers or overlapping alternatives that could cause exponential backtracking. If any are found, consider refactoring to a simpler or anchored pattern. This is a low-priority hardening step; no immediate change is required given the low risk.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- dist/frontend.js:1243
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A security scanner warned that a piece of code that looks for special tags in AI replies could be slow if given a tricky input. But the code only runs on text from the AI, not from you, and it stops after a certain number of tries, so the risk is very small. No real problem has been found.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: JS-X-Ray flagged a regular expression at line 764 of the generated frontend bundle as potentially unsafe (ReDoS). The regex is used in the customBlockLeftOpen function to match HTML-like custom tags on their own lines. It is applied only to AI model output, not to direct user input, and the matching loop has a hard cap of 5000 iterations. Although the regex could theoretically exhibit polynomial backtracking on pathological input, controlling the model output to trigger such behavior is not demonstrated and would require an attacker to influence the AI generation. No concrete exposure or harm is shown.
Impact: low · Exploitability: unlikely
Developer action: Consider simplifying the regex to remove the optional group or to use a possessive quantifier if the JavaScript engine supports it, for defense-in-depth. A non-capturing group with a minimum-change rewrite can prevent any ReDoS potential without altering behavior.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- dist/frontend.js:764
Expected scanner matches (13)
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This script is for developers who want to work on the extension's code themselves. It installs the bun programming tool, which is needed to build the extension. The method used is the normal way to install bun. The script is not something regular users of the extension would ever run, and it only downloads from the official bun website.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The file script is a developer environment bootstrap for working on the Lumiverse-Auto-Retry extension repository. Line 40 contains a fallback installation of the bun runtime using curl piped to bash from the official bun.sh domain. This pattern is the standard and documented method for installing bun, and the script is not shipped or executed by the extension itself—only by developers intentionally setting up a build environment. The script has explicit comments, uses set -euo pipefail, includes error handling, and the URL is a trusted official source. No external or attacker-controlled input flows into the curl URL. There is no evidence of concealed execution, obfuscation, or malicious intent.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- production
- Source
- setup.sh:40
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The test reads an environment variable to find the browser it needs to run tests. That's normal and not a security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment in this repository.
Contextual assessment: Line 287 reads process.env.CHROMIUM_PATH to configure the Playwright browser executable path in a test file. This is standard test setup and does not involve credential exfiltration or any security-relevant data. The scanner rule serialize-environment flags any environment variable access, but here the variable is a configuration path, not a secret. No storage, transmission, or persistence of environment values occurs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/ui.mjs:287
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code checks a color value from the webpage (like 'rgb(255, 0, 0)') to see if the text is readable. The pattern it uses is safe because the browser only gives it proper color strings, not random text from a user or attacker.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex /^rgba?\(\s*([\d.]+)[,\s]+([\d.]+)[,\s]+([\d.]+)(?:[,/\s]+([\d.]+%?))?\s*\)$/i is used in parseColor() to parse CSS rgb()/rgba() color strings returned by getComputedStyle. The input is always a browser-generated color string, not attacker-controlled, so there is no ReDoS vector. The regex is anchored and uses bounded character classes with no nested quantifiers, making backtracking benign. This is a standard pattern for color parsing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- dist/frontend.js:1772
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the extension's backend code to check that the prompt viewer works correctly. It uses a standard JavaScript function to run that code in a controlled test environment. This code never runs for real users; it's only used by the developer to verify the feature.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The new Function call on line 40 of the test file file loads a bundled backend module (dist/backend.js) into a test harness. This is a standard pattern for unit-testing compiled modules without a separate runtime. The test file is not shipped to users; it exists only in the development repository for running bun test. There is no untrusted input, no remote data flow, and no attacker-controlled path. The code includes a clear eslint-disable comment indicating awareness of the pattern. The project's stated purpose and file role confirm this is a test-only harness. No runtime reachability in the shipped extension.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/prompt-viewer.test.ts:40
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
A scanner flagged a regular expression used in a test file, but it's just a simple text match like looking for the words 'Retrying in' on the screen. It's not dangerous and can't be exploited.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The 'unsafe-regex' signal at line 1965 corresponds to `/Retrying in/`, a static literal regex used in a Playwright test to check UI text content. The regex is not user-controllable, does not accept untrusted input, and has no ReDoS risk. This is standard test code with no security concern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- test/ui.mjs:1965
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This regular expression checks if a message says something like 'in 5s' or 'in 1m 30s' and pulls out the numbers. It's only used in a test to make sure the extension's countdown timer works properly. The pattern is safe and can't be tricked into slowing things down.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex `in (?:(\d+)h )?(?:(\d+)m )?(\d+)s` is a static pattern with no nested quantifiers, alternation, or overlapping optional groups that could cause catastrophic backtracking. It is used in a test helper to parse known-format time strings from the extension's own toast UI; it is not exposed to arbitrary user or network input in production. The scanner's 'unsafe-regex' signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- test/ui.mjs:1424
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
Another flagged regex in the test file that simply reads time information like '5m 30s' from the UI. It only works on the test page's own text and isn't exposed to any attacker.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The 'unsafe-regex' signal at line 2004 corresponds to two regexes used in the test: `/Watching for\s*((?:\d+h )?(?:\d+m )?\d+s)/` and `/(?:(\d+)h )?(?:(\d+)m )?(\d+)s/`. These parse duration strings strictly from known text in a test environment, not from user input. No untrusted data reaches these patterns. They present no vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- test/ui.mjs:2004
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The test uses a fake website address to make browser storage work correctly during testing. It doesn't actually connect to that address.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- test/ui.mjs:234
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the extension's backend code into a fake environment to check that it works. The `new Function` line is a common way to run code in a test, not something users would ever run. It is safe.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a test-only file (`file`). Line 43 uses `new Function` to instantiate the backend module from a string loaded from `dist/backend.js`. This is a standard pattern for unit-testing isolated modules without a bundler or runtime module system. The test harness is entirely sandboxed within the test runner and never shipped to end users. The project's production code (`dist/`) is committed as plain JavaScript and does not use `new Function` or `eval`. The candidate does not demonstrate any dynamic execution in a shipped context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/refusal-note.test.ts:43
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This security flag pointed at an ordinary regex used to detect AI model refusals. The regex is simple and safe; it will not freeze your browser or create a security risk. It works as intended and no action is needed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: JS-X-Ray flagged the regex at line 1417 as 'unsafe-regex', but analysis of the actual pattern shows no catastrophic backtracking or ReDoS risk. The regex is `\bi'?d be happy to help (?:you )?(?:with [^.?!\n]{0,40}? )?instead\b/i` — a simple bounded lazy quantifier over a single-character class with no nested quantifiers or ambiguous alternation. The pattern is used in the REFUSAL_SOFT array to match soft redirect tells in AI reply text. It is a legitimate, non-dangerous regex that performs linear matching.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- dist/frontend.js:1417
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the extension's own built script to run automated checks on it. It's like a developer running the code inside a sandbox to see if it works correctly. No user data or malicious code is involved. The test is not shipped to users, so this poses no risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged line uses `new Function("spindle", BACKEND)(spindle)` to load and execute a pre-built backend script in a test harness. This is a test file (`file`) that reads the built `dist/backend.js` and runs it against a stub `spindle` object to verify word-swap behavior. The `BACKEND` string comes from the project's own built output, not from user input or external untrusted sources. Dynamic execution here is by design for test isolation and is not present in shipped code. No untrusted data flows into the function constructor; the test controls both the code string and the arguments. As a test-only pattern, there is no security risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- test/word-swaps.test.ts:72
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The scanner thought the test was downloading code and running it, but this test is just loading the extension's own code into a browser to check how its panel looks. It's not downloading anything from the internet—it uses code that's already part of the extension's files.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution in this repository.
Contextual assessment: The 'download-to-execution' correlation is a false positive in this Playwright test file. The 'network retrieval' primitive (page.addScriptTag) and 'code execution sink' (page.evaluate) are standard Playwright APIs used to load the extension's own source code (SOURCE constant) into a test browser page for UI verification. No external or untrusted network request occurs; the content is compiled at build time from the project source. This is legitimate test infrastructure, not a remote code execution risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.download-to-execution
- File role
- test
- Source
- test/ui.mjs:1949-2470
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged line is part of a test that checks a button's animation style. The regular expression is used to verify that the animation duration is set to zero seconds. Since this test only runs on a developer's machine and does not touch any real user data or external input, it poses no risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regular expression `/^0s(,\s*0s)*$/` is used at line 1163 in `file` to verify that a CSS transition duration string consists only of zero-second entries in a comma-separated list. This is a UI test assertion executed only in a local Playwright test environment against browser-computed style values; it never processes untrusted or attacker-supplied input. The pattern's `\s*` could theoretically cause catastrophic backtracking on a very long malformed string, but the input is a short duration string from the browser's CSS engine and the test runs with no network or user interaction. The file role is 'test' and is not shipped or executed in the production Lumiverse extension. No security-relevant harm can arise from this usage.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- test/ui.mjs:1163