No material or immediate-danger item was identified.
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Minor caution · high confidence
The README suggests users install the app by downloading and running a script from the project's website in one step. This is a common install shortcut but means the user trusts the website and script without reviewing them first. Since this is just text in a help file and not hidden or automatic code, the risk is low.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The scanner matched a curl-piped-to-bash pattern inside a markdown code block in README.md. This is documentation text instructing users to run an install command; it is not executable code shipped in the project. The curl|bash install pattern is a widely used convention but is a known minor security weakness because the user cannot inspect the script before it executes. However, the evidence is a documentation file with no runtime data flow, no concealed execution, and no attacker-controlled trigger within the project itself. The destination is the project's own install script domain. There is no demonstrated exposure of shipped executable behavior.
Impact: low · Exploitability: unlikely
Developer action: Consider providing a checksum or signature for the install script and encouraging users to download and inspect it before execution, but no change is required for this standard documentation practice.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- README.md:39-40
Contextual expected matches (10)
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is just a help page telling users how to install the app on a server. The download-and-run command it shows is the normal install method the project advertises. There is no hidden or harmful code here — only written instructions.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The flagged line is inside a Markdown documentation file (file_role=documentation, execution_scope=test-documentation-data). It shows a standard curl-pipe-to-bash install command from the project's own domain, matching the stated VPS installation purpose documented in the README. No executable code is present; this is static documentation text instructing users. No attacker-controlled data flow, no concealed execution, no obfuscation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/de/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is an install guide page that shows the normal server install command. It is only text for users to follow, not running code, and matches what the project advertises.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The flagged line is in an English Markdown documentation file showing the project's standard curl-pipe-to-bash VPS install command from its own domain. The file_role is documentation and execution_scope is test-documentation-data, so no executable code is present. The command matches the installation method described in the README and is proportionate to the stated purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is a Russian-language install guide showing the normal server install command. It is only written instructions for users, not running code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The flagged line is in a Russian Markdown documentation file showing the standard curl-pipe-to-bash VPS install command from the project's own domain. The file_role is documentation and execution_scope is test-documentation-data. No executable code is present; this is static instruction text matching the project's stated installation method.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/ru/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the same Russian install guide showing the command with a custom-folder option. It is just user instructions, not harmful code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The second match is the same Russian documentation file showing the curl-pipe-to-bash install command with a custom install directory variable. This is static Markdown text, not executable code, and aligns with the project's stated installation purpose. No concealed or obfuscated behavior is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/ru/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is a Spanish-language install guide showing the normal server install command. It is only written instructions for users, not running code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The flagged line is in a Spanish Markdown documentation file showing the standard curl-pipe-to-bash VPS install command from the project's own domain. The file_role is documentation and execution_scope is test-documentation-data. No executable code is present; this is static instruction text matching the project's stated installation method.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/es/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the same Spanish install guide showing the command with a custom-folder option. It is just user instructions, not harmful code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The second match is the same Spanish documentation file showing the curl-pipe-to-bash install command with a custom install directory variable. This is static Markdown text, not executable code, and aligns with the project's stated installation purpose. No concealed or obfuscated behavior is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/es/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the same install instruction, shown with an option for choosing a custom folder. It is still just documentation text for users to copy manually. No harmful behavior is present.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The second match is the same curl-pipe-to-bash install command, this time with a TAVERNAI_INSTALL_DIR environment variable for custom install paths. It appears in the same Markdown documentation file as a code-fenced installation example. No runtime execution occurs from this documentation text; it is a user-facing instruction matching the project's stated purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/de/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the same help page showing the install command with a custom-folder option. It is just user instructions, not harmful code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The second match is the same documentation file showing the curl-pipe-to-bash install command with a custom install directory variable. This is static Markdown documentation text, not executable code. It aligns with the project's stated installation purpose and contains no concealed or obfuscated behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is a French-language install guide showing the normal server install command. It is only written instructions for users, not running code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The flagged line is in a French Markdown documentation file showing the standard curl-pipe-to-bash VPS install command from the project's own domain. The file_role is documentation and execution_scope is test-documentation-data. No executable code is present; this is static instruction text consistent with the project's stated installation method.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/fr/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the same French install guide showing the command with a custom-folder option. It is just user instructions, not harmful code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The second match is the same French documentation file showing the curl-pipe-to-bash install command with a custom install directory variable. This is static Markdown text, not executable code, matching the project's stated installation purpose. No concealed or obfuscated behavior is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/fr/docs/installation.md:94-95