No material or immediate-danger item was identified.
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Minor caution · high confidence
The project's instruction page tells Linux server users to run one command that downloads and immediately runs an installer from the project's own website. This is a very common and openly displayed way to install software, not something hidden. The small downside is that the installer lives on the website rather than in the public code, and the instructions do not mention a way to check that the download has not been tampered with, so users must trust that the project's website stays secure.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The matched lines are documentation, not shipped executable code: the readme's server-installation section shows a single shell command that fetches an installer from the project's own website and pipes it straight into a shell interpreter. The instruction is fully disclosed, user-initiated, points only to the project's own domain, and is proportionate to the stated purpose of installing the application on a Linux server; this is a widespread installation convention and shows no concealment, unexpected destination, or malicious behavior. The residual weakness is supply-chain hygiene: the remotely served installer is not part of this repository, so its behavior cannot be audited from the supplied source, and the instructions document no checksum or signature verification, meaning users executing the one-liner rely entirely on the continued integrity of the project's web hosting. The readme does separately offer directly downloadable release artifacts, and no attacker-controlled trigger or untrusted-input path is present in the supplied evidence.
Impact: low · Exploitability: unlikely
Developer action: Consider publishing the installation script inside the repository so it can be reviewed with the rest of the source, and documenting a checksum or signature verification step, or guiding server users toward the verifiable release archives. This is a hygiene improvement, not an urgent fix.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- README.md:39-40
Contextual expected matches (10)
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is a line in the instruction manual, not program code. It tells a person setting the app up on their own server to run the project's official one-line installer from the project's own website. Downloading and running the project's own installer is a normal, openly documented step the user types themselves; nothing runs secretly or sends data anywhere unexplained.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is a fenced shell snippet inside a localized Markdown installation guide; the file is documentation and executes nothing itself. The snippet documents the project's server-install step, in which the user manually runs a one-line pipeline that fetches the installer from the project's own website over HTTPS and pipes it into a shell. This is the identical install method published in the README, is fully disclosed, matches the stated purpose of installing the application, and is accompanied by a plain-language description of what the installer does plus security guidance (setting a profile password before exposure, firewall rules, HTTPS reverse proxy). No concealed execution, unexpected destination, attacker-controlled input, persistence surprise, or obfuscation is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/de/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is an instruction in the manual that lets someone pick a custom folder when installing. The person still types and runs the official installer from the project's own website themselves; it is an ordinary, openly documented option.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is a fenced shell snippet in the English installation guide, a documentation file with no runtime behavior. It documents the install variant where the user sets an environment variable to choose a custom installation directory before running the project's official installer fetched over HTTPS from the project's own website. The command matches the install method in the README, is visible to and executed by the user, fits the stated purpose, and the variable is a documented option rather than attacker-controlled input.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the Russian manual's install instruction with a folder-choice option. The user still runs the project's official installer themselves; it is an ordinary documented step.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is the custom-install-directory variant of the server-install command in the Russian translation of the installation guide. The file is documentation only; the snippet shows the user manually running the project's installer fetched over HTTPS from the project's own website, matching the install method in the README. The environment variable is a documented user-supplied option, and no concealed execution, alternate destination, or untrusted input is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/ru/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the Russian version of the manual's server install instruction. It downloads and runs the project's own installer from the project's official website when the user chooses to, and the manual explains what happens. That is a normal install step, not suspicious behavior.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is the primary server-install snippet in the Russian installation guide. It documents the user manually piping the project's installer, retrieved over HTTPS from the project's own website, into a shell; this is the same command published in the README and the standard disclosed one-line install pattern for this kind of application. The surrounding documentation explains what the installer does and includes protective guidance on passwords, firewalls, and reverse proxies. There is no hidden execution, unexpected destination, attacker-controlled trigger, or obfuscation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/ru/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the Spanish version of the manual's server install instruction. It tells the user to run the project's official installer from the project's own website, a normal step the user performs themselves while the manual explains what it does.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is the primary server-install snippet in the Spanish translation of the installation guide. The file is documentation and executes nothing; the snippet shows the user manually piping the project's installer, fetched over HTTPS from the project's own website, into a shell. This mirrors the install command in the README, is disclosed, is proportionate to the documented purpose, and is surrounded by a description of the installer's actions and security guidance. No hidden execution, unexpected destination, or attacker-controlled input exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/es/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the Spanish manual's same install instruction with a folder-choice option. The user still runs the official installer themselves; nothing is hidden or unusual.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is the custom-install-directory variant of the same command in the Spanish installation guide. It remains a documentation-only fenced snippet executed manually by the user, fetching from the project's own HTTPS website and consistent with the README's documented install method. The environment variable is a user-supplied documented option, not an untrusted-input path, and there is no concealed or disproportionate behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/es/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the same manual instruction with an option that lets the user choose which folder to install into. It is still a step the user types and runs themselves using the project's official installer from the project's own site; nothing about it is hidden or unusual.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: This is the same documented install command from the same localized installation guide, with an environment variable that selects a custom installation directory. It remains a documentation-only fenced snippet that the user manually copies and runs; the fetch still targets the project's own HTTPS website and matches the install method published in the README. The environment variable is a documented install option supplied by the user, not an untrusted-input injection path, and no hidden execution or unexpected destination exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/de/docs/installation.md:94-95
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the manual's one-line server install instruction. It downloads the project's own installer from the project's official website and runs it, which the user does deliberately and with the manual explaining what happens. This is a normal install step, not hidden or suspicious behavior.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is the primary VPS install instruction in the English installation guide, presented as a fenced shell snippet the user runs manually. It fetches the project's installer over HTTPS from the project's own website and pipes it into a shell, which is the same install method published in the README and is the standard, disclosed one-line install pattern for this class of application. Surrounding text describes the installer's actions and adds protective guidance such as setting a profile password before internet exposure and firewall configuration. No concealed execution, alternate destination, or untrusted input is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the French version of the manual's server install instruction. It has the user run the project's official installer from the project's own website, a normal documented step performed by the user.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is the primary server-install snippet in the French translation of the installation guide, a documentation file with no execution of its own. It documents the user manually running the project's installer fetched over HTTPS from the project's own website, identical to the install method in the README. The behavior is disclosed, user-initiated, proportionate to the stated purpose, and accompanied by an explanation of the installer's actions plus protective advice. No concealed execution, unexpected destination, or attacker-controlled input is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/fr/docs/installation.md:43-44
OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline
Expected behavior · high confidence
This is the French manual's same install instruction with an option for choosing the install folder. It is still the official installer run by the user; nothing is hidden.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The match is the custom-install-directory variant of the same documented command in the French installation guide. It is still a fenced documentation snippet run manually by the user, fetching from the project's own HTTPS website, consistent with the README's published install method; the environment variable is a documented option rather than an injection vector.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.download-and-execute.shell-pipeline
- File role
- documentation
- Source
- docs-site/docs/fr/docs/installation.md:94-95