The install guide tells users to download and run a setup script from the project's own website in one step. This is a common convenience, but it means users run code they have not read first. The risk is low because it uses the project's official secure website and serves an obvious install purpose.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: Documentation instructs users to pipe a remote install script from the project's own HTTPS domain directly into a shell. This is a widely used install pattern and the destination matches the project's stated distribution channel. The inherent weakness is that users cannot inspect the script before execution and must trust the domain's integrity; compromise of the domain or a TLS interception could deliver arbitrary commands. No obfuscation, unexpected destination, or concealed execution is present.
Impact: low · Exploitability: unlikely
Developer action: Consider offering a two-step install (download, inspect, then run) alongside the one-liner so users can review the script before execution.
This is the same one-line install command, just with an option to choose a custom install folder. It carries the same low-risk tradeoff of running a script from the official website without reading it first.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: Same curl-piped-to-bash install pattern as the other candidate, with an environment variable setting a custom install directory. The destination is the project's own HTTPS domain and the purpose is installation. The same inherent lack of pre-execution inspection applies. No hidden destination, obfuscation, or behavior beyond stated install purpose is present.
Impact: low · Exploitability: unlikely
Developer action: Consider offering a two-step install (download, inspect, then run) alongside the one-liner so users can review the script before execution.
The README tells Linux server users to download and run an installation script from the project's website in one step. This is a widely used installation shortcut, but it means the user trusts whatever the website serves at that moment without checking it first. If someone hacked the website, they could replace the script with malware. This is a minor security weakness in the installation instructions, not a flaw in the application itself.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The flagged content is a bash code block inside README documentation that instructs users to pipe a remote install script directly into bash. This is a common installation pattern used by many legitimate projects, and the URL points to the project's own domain. The content is not executable code committed to the repository; it is a manual installation instruction that a user must copy and paste. The weakness is the lack of integrity verification: the fetched script could change at any time and is not checksummed or signed, so a compromise of the hosting server would allow arbitrary code execution on any user who runs the command. However, exploitation requires compromising the project's own web server, the user must manually execute the command, and the project explicitly states it has no telemetry or background update behavior.
Impact: low · Exploitability: unlikely
Developer action: Consider providing a checksum or signature for the install script and documenting a two-step download-then-verify-then-run procedure, or link to the GitHub release packages as the primary installation method.
This is just instructions in a help document telling users how to install the app. The command shown is a common way to install software and comes from the project's own website. Nothing runs by itself.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The matched line is documentation text inside a Markdown installation guide. It instructs users to run the project's own installer from the project's official domain. This is a standard, openly documented install method, not concealed execution or exfiltration. No code in this file executes automatically; users must manually copy and run the command.
This is just install instructions in the documentation. It tells users to run a one-line install command from the project's own website, which is a common way to install software on a server. Nothing hidden or malicious is happening here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The matched line is documentation text showing a VPS install command that pipes a remote installer script from the project's own domain into bash. This is a standard, user-facing install instruction in a markdown documentation file, not executable code in the repository. The command is visible to users, uses the project's official domain, and matches the stated project purpose of providing a Linux/VPS installer. No obfuscation, concealment, or unexpected execution is present.
This is an installation guide that tells users to run a standard one-line install command from the project's own website. The user copies and runs it themselves; nothing is hidden or auto-executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The flagged content is a documentation file describing VPS installation. It instructs the user to manually run a curl-piped-to-bash command against the project's own domain to install the application. This is a widely used, explicitly disclosed install pattern; the command is not executed by the project itself, is visible to the user, and matches the stated installation purpose.
This is the same install guide, showing how to install to a custom folder by setting a variable before running the standard install command. It is visible to the user and run manually.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The flagged content is the same documentation file showing an alternate install path that sets an environment variable before piping the project's own install script to bash. It is a user-initiated, explicitly documented command with no concealed execution or unexpected destination, consistent with the project's installation purpose.
This is another line in the same help document, showing how to install the app into a custom folder. It is normal documentation and does not run on its own.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The matched line is documentation text showing the same installer invocation with an optional install-directory environment variable. It is part of the installation guide, openly disclosed, and requires manual user execution. No hidden behavior, credential access, or unexpected destination is present.
This is another install instruction in the documentation, this time showing how to choose a custom install folder. It is the same normal install method, just with an option set. Nothing suspicious here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The matched line is documentation text showing the same VPS install command with an environment variable for a custom install directory. It is a markdown documentation instruction, not executable code. The command is visible, uses the project's official domain, and aligns with the stated purpose of providing a configurable Linux installer. No concealment or unexpected behavior is present.
This is just an instruction in the help guide telling users how to install the software on a server. It uses a common shorthand for downloading and running an installer. It is normal for this kind of documentation.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The candidate is a documentation snippet showing a standard curl-piped-to-bash installation command for the project's own software from its official domain. This is a common installation method for Linux servers and VPS environments. The file is a markdown documentation file and does not execute code itself. The URL matches the project's stated purpose and official website.
This is another instruction in the help guide showing how to install the software into a custom folder. It is a normal variation of the standard install command and is not dangerous.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.
Contextual assessment: The candidate is a second documentation snippet showing the same official installer invocation with an environment variable to customize the installation directory. It is part of the installation guide and does not execute code within the repository. The command targets the project's official domain and matches the stated installation purpose.
Piped installer in documentation is standard and openly disclosed
low risk · high confidence
The install instructions use a normal one-line install command from the project's own site and include safety advice about passwords and firewalls. This is typical for server software documentation.
Technical assessment
Both candidates are the same documented install pattern from the project's official domain, shown in a Markdown guide for VPS installation. The pattern is common for server installers and is not concealed. The documentation also advises setting a profile password and firewall rules before exposing the instance, indicating good-faith guidance.
Piping remote installer to bash without integrity verification
low risk · medium confidence
The install instructions tell users to download and run a script in one step without checking that the script hasn't been tampered with. This is common, but adding a checksum or signature check would make it safer if the website were ever compromised.
Technical assessment
The documented install method fetches a shell script over HTTPS and pipes it directly into bash without a checksum or signature verification step. This is a widely used pattern but relies entirely on the transport security and integrity of the hosting domain. If the domain or CDN were compromised, users running the documented command would execute attacker-controlled code. This is a documentation-level hardening consideration, not evidence of malicious intent.
Impact: low · Exploitability: plausible
Developer action: Consider documenting an optional checksum or signature verification step for users who want to verify the installer before execution.