TavernKeeper Scan Report

valdoix/vellum-engine

Commit 69eca23 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 14 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

Dependency advisory GHSA-g7r4-m6w7-qqqr applies

Minor caution · low confidence

A security scanner found a low-severity issue in a development tool used only to build or test this extension, not in the code that actually runs for users. Because this tool is not part of what gets installed by end users, it is very unlikely to affect anyone using the extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-g7r4-m6w7-qqqr to a dependency declared by this repository.

Contextual assessment: A low-severity advisory matched by osv-scanner against a declared dependency in the lockfile. The project workspace declares only zod as a production runtime dependency; all other visible dependencies are devDependencies used for building, testing, and type-checking (tsup, vitest, typescript, fontsource, etc.). The lockfile source provided is truncated at line 161 and package names were stripped from the scanner candidate, so the exact affected package and version cannot be confirmed from the supplied evidence. Given the project is a Lumiverse browser extension that ships bundled code to end users, build-time dev dependency vulnerabilities have no runtime reachability in the shipped artifact. Concrete user harm is not established.

Impact: none · Exploitability: unlikely

Developer action: Update the affected development dependency to a patched version at the next maintenance cycle; no urgent action is required.

Scanner
osv-scanner 2.4.0
Rule
GHSA-g7r4-m6w7-qqqr
File role
production
Source
bun.lock

Dependency advisory GHSA-67mh-4wv8-2f99 applies

Minor caution · low confidence

A scanner flagged a medium-severity issue in a dependency. Based on the project structure, the flagged package appears to be a build or development tool rather than something that runs in the extension itself, so it is unlikely to impact users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-67mh-4wv8-2f99 to a dependency declared by this repository.

Contextual assessment: A medium-severity advisory matched against a declared dependency in the lockfile. Package details were stripped from the candidate and the lockfile source is truncated, preventing exact identification. The workspace's sole production runtime dependency is zod; remaining visible dependencies are build-time devDependencies that do not ship in the extension bundle. Without confirmation that the advisory's vulnerable code path is reachable at runtime in the shipped artifact or that attacker-controlled input reaches it, advisory severity alone does not establish user harm.

Impact: none · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-67mh-4wv8-2f99
File role
production
Source
bun.lock

Dependency advisory GHSA-5xrq-8626-4rwp applies

Minor caution · low confidence

A scanner flagged a critical-severity issue in a dependency. While the word critical warrants attention, the affected package appears to be a development or build tool rather than code that runs inside the extension. There is no evidence that this issue can be reached by anyone using the finished extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-5xrq-8626-4rwp to a dependency declared by this repository.

Contextual assessment: A critical-severity advisory matched against a declared dependency. Package details were stripped and the provided lockfile source is truncated at line 161, so the exact affected package cannot be confirmed from the supplied evidence. The project's workspace declares only zod as a production runtime dependency; the rest are devDependencies for build, test, and type tooling. For a browser extension shipped as bundled code, vulnerabilities in build-time dev dependencies have no runtime reachability in the deployed artifact. Per policy, advisory severity alone is not an immediate-danger conclusion; there is no evidence of attacker-controlled input reaching vulnerable code in the shipped extension or concrete user harm.

Impact: low · Exploitability: unlikely

Developer action: Investigate which dependency is flagged, confirm whether it is development-only, and update it to a patched version. If it is a development dependency, prioritize is lower but should not be left unpatched indefinitely.

Scanner
osv-scanner 2.4.0
Rule
GHSA-5xrq-8626-4rwp
File role
production
Source
bun.lock

zizmor reported excessive-permissions

Minor caution · medium confidence

The automated test pipeline does not explicitly restrict what its built-in access token can do. Since the pipeline only runs tests and builds the project, it should declare the minimum access it needs. This is a minor hygiene issue, not a sign of any threat.

Technical evidence

Scanner reason: zizmor matched workflow-security rule excessive-permissions in this repository.

Contextual assessment: The workflow defines no explicit permissions block. The job only checks out source, installs dependencies, and runs typecheck, test, and build. It does not upload artifacts, push releases, or consume repository secrets. Absent an explicit permissions declaration, the token scope falls back to repository defaults, which is broader than the read-only access this job requires. Adding a top-level permissions block limiting to contents: read would align with least-privilege practice.

Impact: low · Exploitability: unlikely

Developer action: Add a top-level permissions block with contents: read to the workflow.

Scanner
zizmor 1.28.0
Rule
excessive-permissions
File role
tooling
Source
.github/workflows/ci.yml:8-19

zizmor reported artipacked

Minor caution · low confidence

The checkout step leaves a temporary access token on the build machine. Because this pipeline never saves or shares any build results, that token cannot realistically leak. It is a minor best-practice gap rather than a real danger.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The artipacked concern relates to the checkout action persisting the GITHUB_TOKEN in local git configuration and that token later leaking through uploaded artifacts. This workflow performs no artifact upload, no release publishing, and no cross-job artifact passing. The token is scoped to the ephemeral runner and discarded with the job. The residual risk is negligible for this job shape, though using persist-credentials: false on checkout would eliminate the persistence entirely.

Impact: low · Exploitability: unlikely

Developer action: Consider setting persist-credentials: false on the checkout step to avoid leaving the token in runner git config.

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/ci.yml:11

zizmor reported unpinned-uses

Minor caution · high confidence

The pipeline uses a version label for a third-party build step instead of locking it to an exact version. If that step were ever tampered with, future builds could be affected. This is a standard hardening recommendation, not an active problem.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The checkout action is referenced by major version tag rather than a pinned commit SHA. Tag-based references are mutable, so a compromise of the action repository could alter behavior for future runs. This is a common CI hygiene finding. For a workflow that only runs local typecheck, test, and build with no secrets or deployment, the practical impact is low. Pinning to a SHA would improve supply-chain integrity.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a specific commit SHA for reproducibility and supply-chain integrity.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:11

zizmor reported unpinned-uses

Minor caution · high confidence

The pipeline uses a version label for the Bun setup step instead of locking it to an exact version. This is a minor hardening recommendation with no practical danger for this test-only pipeline.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The setup-bun action is referenced by major version tag rather than a pinned commit SHA. The same supply-chain consideration applies as with the checkout action. The job uses no secrets and performs no deployment, so the practical risk is low. Pinning to a SHA would improve integrity.

Impact: low · Exploitability: unlikely

Developer action: Pin oven-sh/setup-bun to a specific commit SHA for reproducibility and supply-chain integrity.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/ci.yml:12

Dependency advisory GHSA-v6wh-96g9-6wx3 applies

Minor caution · low confidence

A scanner flagged a medium-severity issue in a dependency that appears to be related to build or development tooling rather than the running extension. It is unlikely to affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-v6wh-96g9-6wx3 to a dependency declared by this repository.

Contextual assessment: A medium-severity advisory matched against a declared dependency. Package details were stripped from the candidate and the lockfile source is truncated, preventing exact package identification. The project workspace lists only zod as a runtime dependency; all other visible dependencies are build-time devDependencies. There is no evidence the vulnerable code path is reachable at runtime in the shipped extension artifact.

Impact: none · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-v6wh-96g9-6wx3
File role
production
Source
bun.lock

Dependency advisory GHSA-r28c-9q8g-f849 applies

Minor caution · low confidence

A scanner flagged a high-severity issue in a dependency. Based on the project structure, the flagged package appears to be a development or build tool. There is no evidence this issue can affect users of the finished extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: A high-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated at line 161, so the exact affected package cannot be confirmed. The project workspace declares only zod as a production runtime dependency; all other visible dependencies are devDependencies for build and test tooling. A high advisory severity is candidate-locating evidence, not a final conclusion. There is no evidence that the vulnerable code is reachable at runtime in the shipped extension or that attacker-controlled input reaches it.

Impact: none · Exploitability: unlikely

Developer action: Identify the flagged dependency and update it to a patched version; confirm whether it is development-only.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
bun.lock

Dependency advisory GHSA-4w7w-66w2-5vf9 applies

Minor caution · low confidence

A scanner flagged a medium-severity issue in a dependency that appears to be build or development tooling rather than the running extension. It is unlikely to affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-4w7w-66w2-5vf9 to a dependency declared by this repository.

Contextual assessment: A medium-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated, preventing exact identification. The project workspace declares only zod as a runtime dependency; remaining visible dependencies are devDependencies. There is no evidence the vulnerable code path is reachable in the shipped extension artifact.

Impact: none · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-4w7w-66w2-5vf9
File role
production
Source
bun.lock

Dependency advisory GHSA-fx2h-pf6j-xcff applies

Minor caution · low confidence

A scanner flagged a high-severity issue in a dependency. Based on the project structure, the flagged package appears to be a development or build tool. There is no evidence this issue can affect users of the finished extension.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fx2h-pf6j-xcff to a dependency declared by this repository.

Contextual assessment: A high-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated at line 161, so the exact affected package cannot be confirmed. The project workspace declares only zod as a production runtime dependency; all other visible dependencies are devDependencies for build and test tooling. Advisory severity alone is not a final conclusion. There is no evidence the vulnerable code is reachable at runtime in the shipped extension or that attacker-controlled input reaches it.

Impact: none · Exploitability: unlikely

Developer action: Identify the flagged dependency and update it to a patched version; confirm whether it is development-only.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fx2h-pf6j-xcff
File role
production
Source
bun.lock

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Minor caution · low confidence

A scanner flagged a medium-severity issue in a dependency that appears to be build or development tooling rather than the running extension. It is unlikely to affect end users.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: A medium-severity advisory matched against a declared dependency. Package details were stripped and the lockfile source is truncated, preventing exact identification. The project workspace declares only zod as a runtime dependency; remaining visible dependencies are devDependencies. There is no evidence the vulnerable code path is reachable in the shipped extension artifact or that attacker-controlled input reaches it.

Impact: none · Exploitability: unlikely

Developer action: Update the flagged dependency to a patched version during routine maintenance.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
bun.lock
Expected scanner matches (0)

None.

Related contextual observations

CI workflow is a minimal test and build pipeline with no secret or deployment surface

low risk · high confidence

This automated pipeline simply checks that the project compiles and tests pass. It does not handle passwords, publish anything, or talk to outside services. The flagged items are routine best-practice suggestions for any open-source project, not signs of a problem.

Technical assessment

The workflow runs only on push and pull request to the main branch. Its single job checks out source, installs dependencies with a frozen lockfile, and runs typecheck, test, and build. It does not handle repository secrets, publish packages, upload artifacts, or interact with external services beyond the standard hosted runner environment. All four scanner findings are standard GitHub Actions hygiene recommendations rather than indicators of malicious behavior or material vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Dependency graph is dominated by build-time devDependencies; sole production runtime dependency is zod

low risk · medium confidence

The extension only depends on one package at runtime; everything else in the dependency list is used to compile, bundle, or test the code and never reaches the user. Security issues in those build tools are worth fixing for good hygiene but are unlikely to affect anyone who installs the extension.

Technical assessment

The workspace root declares only zod as a runtime dependency. All other visible workspace-level dependencies are devDependencies: font packages, type definitions, the tsup bundler, typescript, and vitest. The packages section of the lockfile visible in the supplied source (lines 23-161) contains only transitive dependencies of these build tools: esbuild platform binaries, rollup platform binaries, jridgewell source-map utilities, vitest sub-packages, and acorn. These are consumed at build or test time and do not ship in the bundled extension artifact that end users run. Consequently, advisories against these packages do not establish runtime reachability in the deployed extension.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity