No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A crafted input might briefly slow or freeze the local client, without showing broader security harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.
Impact: low · Exploitability: plausible
Developer action: Bound the input length or replace the expression when practical.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- test/ui.mjs:2341
Contextual expected matches (6)
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is a setup helper for people developing the extension, not something the chat app runs when you install it. When the build tool is missing, it falls back to downloading and running that tool's own official installer from the maker's website, which is the maker's recommended install method. The scanner flags the download-and-run shape because it can be abused, but here the destination, the reason, and the openness all match ordinary development practice, and danger would require the tool maker's own site to be compromised.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is in a developer-environment bootstrap script, not code the chat host loads; the project documentation states only the two committed plain-JavaScript modules are loaded at runtime. The flagged line pipes a download to a shell, but the source is the toolchain vendor's documented installer endpoint fetched over HTTPS, used solely as a fallback when a package-manager install of the build tool has already failed and the tool is absent. There is no obfuscation, the intent is stated in adjacent comments, errors are deliberately left visible, and nothing reads credentials, installs hidden persistence, or contacts any destination unrelated to preparing a development sandbox. Harm would require compromise of the vendor's official install infrastructure, which the supplied evidence does not demonstrate; the shape alone is the standard documented install method for this tool.
Impact: low · Exploitability: unlikely
Developer action: Optional hardening only: verify the installer against a published checksum or rely on the package-manager path and drop the download fallback; no change is required for the shipped extension.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- production
- Source
- setup.sh:40
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
An automated scanner suggested this file might be collecting and copying information about your computer, as credential-stealing software does. What the code actually does is check one optional setting that tells the testing tool where to find a web browser on the person's own machine so it can run interface checks. Nothing is gathered, saved, or sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The flagged line is part of a CSS theme-variable string embedded in a browser UI test script, not executable environment handling. The only environment access visible anywhere in the supplied source is a single optional variable lookup used to point the local test browser launcher at an already-installed browser. The value is neither serialized into a larger object, persisted, nor transmitted to any destination. The scanner's credential-theft framing does not correspond to any data flow present in this file, and the file itself is a test harness rather than code loaded by the shipped extension.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- test
- Source
- test/ui.mjs:324
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The scanner flagged a text-matching pattern, worried it could be made to hang on cleverly crafted text. This one finds HTML-like tags in a reply so the word-swap feature does not accidentally rewrite them, and it was deliberately written with limits that prevent the runaway behavior the scanner is looking for. Even in a worst case, the effect would be a short slowdown while checking one message on your own machine, not lost data or anything sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged item is a literal markup-scanning regular expression in the backend swap module, used to locate HTML-like tag spans in a reply so find-and-replace rules skip tag and attribute names. Examining the actual pattern: the alternatives inside the repeated group are disjoint on their first character (a double quote, a single quote, or any other non-quote non-greater-than character), the repetition is explicitly bounded, and there are no nested ambiguous quantifiers, so exponential backtracking is not reachable. The residual worst case is polynomial-time scanning on pathological input such as long runs of quote or open-bracket characters, which at most briefly delays processing of a single locally held message. The pattern matches the documented purpose of the word-swap feature, sends no data anywhere, and touches no credentials. The scanner signal is a heuristic match on regex shape, not a demonstrated defect.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- dist/backend.js:514
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The scanner flagged several text-matching patterns in the part of the extension that judges whether a reply was cut off or refused. Reading them, each one has built-in limits on how much it can re-scan, so the runaway hang the scanner worries about is not achievable. At worst, a deliberately weird message could make checking that one message slightly slower on your own machine; nothing is exposed, sent anywhere, or damaged.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The frontend module contains several pattern families: a markup-tag scanner structurally identical to the backend one (first-character-disjoint alternatives, repetition capped at a fixed bound, no nested ambiguous quantifiers), refusal-phrase detectors whose intermediate matches are all capped at small fixed bounds, line-anchored tag counters wrapped in iteration-capped loops, and short anchored utility patterns for selector and color parsing. None of these admits catastrophic backtracking. The residual worst case across these patterns is bounded polynomial work on adversarial reply text, which manifests as a temporary local slowdown during reply analysis. All of it operates on locally held message text, matches the extension's stated detection purposes, and involves no network egress, credentials, or persistence.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- generated
- Source
- dist/frontend.js:847
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This is the project's automated interface test. It opens a throwaway browser window on the developer's machine, loads the extension's own code from the local files, and pokes at its pop-ups, panel, and clock to make sure they behave. The scanner saw patterns that can look like fetch-code-then-run-it, but the only code being run is the project's own, already on the developer's disk, in a test the developer runs deliberately. Nothing is fetched from the internet and run, nothing leaves the machine, and this file is not part of what users install.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The flagged region is a UI test harness, not shipped extension code. It launches a local browser, stages a synthetic host page with stub event and UI APIs, injects the project's own extension source into that test page, and drives synthetic generation events to assert interface behavior: retry pop-up countdown and dismissal, streaming stand-in text, panel layout on phone widths, stats clock and interval cleanup, theming, and settings labels. The dynamic-execution signal corresponds to loading the project's own locally-read source into a browser the harness itself controls; the supplied context shows no flow of network-retrieved content into any execution sink, no external destinations, and no behavior beyond exercising the extension against fake events. The rule is a same-representation correlation between a retrieval primitive and an execution primitive, which by itself does not demonstrate exposure. The file also runs only as developer automation and is not among the artifacts the host application loads for end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- test
- Source
- test/ui.mjs:3290-4125
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner saw web addresses in a test script and flagged them as suspicious links. They are a fictional placeholder address that the test framework answers itself on the same computer, which is a standard way to give a test page working storage. The tests never contact a real website and nothing is sent out.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line sits inside a pixel-decoding helper that unwinds PNG scanline filters so the test can measure on-screen contrast. The only address-like literals in the file are a made-up placeholder origin on a domain reserved for testing, used by the automation harness so browser storage APIs work during checks. Every navigation to that origin is intercepted and answered locally with inline HTML before any request leaves the process, so there is no external destination, no outbound data flow, and no network access in practice. The scanner's network-access category reflects the literal's shape, not any real connection.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- test/ui.mjs:261