TavernKeeper Scan Report

valdoix/vellum-engine

Commit 69eca23 Reviewed Aug 27, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 20 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (15)

Dependency advisory GHSA-2v37-7h3g-55p8:pkg:bcb01fa3f22fe943388f7142 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:c9523a0885d757426ed83e80 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-r28c-9q8g-f849:pkg:6f926e74aaf2969f045549e9 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
zizmor reported excessive-permissions · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:8-19
JavaScript analysis reported javascript.xray.short-identifiers · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

This technical signal is not part of the shipped runtime behavior.

Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

Source: test/clock.test.ts:1
Dependency advisory GHSA-fx2h-pf6j-xcff:pkg:4d43116c7f40e099d5763941 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
zizmor reported artipacked · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:11
Dependency advisory GHSA-28wg-ghj8-5hjv:pkg:590275f7f1e65a0bda08b540 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:11
Dependency advisory GHSA-5xrq-8626-4rwp:pkg:9050b80cbfdd759d03b3d57f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-g7r4-m6w7-qqqr:pkg:49d70202ab5a1e786e48c24f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
zizmor reported unpinned-uses · zizmor 1.28.0

The code has a known weakness, though this scan does not show that anyone can exploit it here.

Policy reason: zizmor-known-workflow-rule · Execution scope: automation

Source: .github/workflows/ci.yml:12
Dependency advisory GHSA-4w7w-66w2-5vf9:pkg:b05cf1d2fd08e11489a53642 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-67mh-4wv8-2f99:pkg:9f437f50cb9a95220530f4b0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock
Dependency advisory GHSA-v6wh-96g9-6wx3:pkg:c56121eae41b737e771f5dfe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: bun.lock

Contextual expected matches (4)

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged regexes are simple date, time, and text-matching patterns used to parse story content for the continuity tracker. They do not have the nested-quantifier structure that causes runaway regex hangs, and the scanned text is local story data, not attacker-controlled input. No security risk.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The JS-X-Ray unsafe-regex signal flags regular expressions heuristically. The visible patterns in this generated backend module are bounded literal/alternation regexes for date detection (e.g. /(?:Jan|Feb|...)[a-z]*?.../), time parsing (/d{1,2}:d{2}.../), and state-block delimiters (^caught up...). None exhibit catastrophic backtracking (no nested quantifiers over overlapping alternations). They operate on AI-generated story text and host chat state via the spindle API, which matches the project's stated continuity-engine purpose. No network, credential, or exfiltration data flow is present. The signal is a static heuristic, not demonstrated exploitable behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/backend.js:7

JavaScript analysis reported javascript.xray.suspicious-literal

Expected behavior · high confidence

The flagged text is a large base64 blob, but it is font data embedded directly in the file so fonts load without contacting any external server. The blob is never executed as code and never leaves the browser. This is normal and harmless.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.suspicious-literal. The match applies to this repository.

Contextual assessment: The suspicious-literal signal is triggered by the large base64 woff2 font payload embedded in FONT_FACES. The base64 content begins with d09GMgAB, the standard woff2 magic bytes, confirming it is a web font binary, not executable code. The data is used solely as a data: URI inside @font-face CSS declarations injected via the UI styling mechanism. There is no eval, no network fetch, no credential access, and no dynamic code generation. The comment in the file states the fonts are generated at build time from @fontsource packages and are self-hosted with no runtime network calls, which is consistent with the observed data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.suspicious-literal
File role: production
Source: src/ui/fonts.ts:1

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

The scanner called this obfuscated code because of the huge encoded string, but it is just a font file embedded as text. It is loaded by the browser as a font, not run as a program, and it does not touch any credentials or send data anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The obfuscated-code signal is a false positive produced by the large base64-encoded woff2 font payload. The content is static CSS @font-face declarations with data: URIs, not obfuscated JavaScript. The base64 payload decodes to a woff2 font binary (d09GMgAB magic header) sourced from @fontsource at build time. There is no function construction, no string-to-code evaluation, no concealed control flow, and no external destination. The data flow is purely local: the string is injected as a style rule and consumed by the browser font renderer.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.obfuscated-code
File role: production
Source: src/ui/fonts.ts:1

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The flagged regexes are simple time-matching and UI template-substitution patterns used by the extension's frontend. They run on preset content and story text, not untrusted attacker input, and lack the structure that causes regex hangs. No security issue.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The unsafe-regex signal flags heuristically suspect patterns. The visible frontend regexes are a time parser (/b(d{1,2})(?::(d{2}))?s*(am|pm)?b/i), a caught-up marker (^caught up...), and template helpers ({{var::...}}, {{if::...}} with .*? and the s flag, {{pick::...}}). These operate over extension/preset content strings and rendered UI text; none contain nested quantifiers that produce exponential backtracking on realistic inputs. The template .*? patterns are bounded by the template delimiters themselves. No credential, network, or exfiltration flow is present; behavior matches the stated UI/preset-engine purpose.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: generated
Source: dist/frontend.js:3

Related contextual observations

Base64 woff2 font payloads triggered static-analysis obfuscation signals

low risk · high confidence

Both scanner signals are explained by the same embedded font data. The fonts are bundled locally so no external request is needed, which is a privacy-friendly design choice for an AI roleplay extension.

Technical assessment

The file exports a FONT_FACES array of CSS @font-face strings with inline base64 woff2 data URIs. The woff2 magic bytes (d09GMgAB) are visible at the start of each blob, confirming legitimate font binaries rather than executable or obfuscated code. The file header documents that these are build-time-generated @fontsource bundles loaded via the host UI styling helper, with no runtime network calls. No execution, exfiltration, persistence, or credential access is present.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

src/ui/fonts.ts:1

Coverage and limitations

Inventory: 217 files · 11159429 bytes
Contextual coverage: 19 of 19 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 190 files · 3437573 bytes
X-Ray review families: 12 warning occurrences compacted to 5 evidence-preserving review families
Representations: 190 raw · 565 decoded · 26 normalized · 0 bundle modules
Stage scans: 189 raw signatures · 16 raw AST · 188 raw OpenGrep · 591 derived signatures · 53 derived AST · 586 derived OpenGrep

Unresolved JavaScript stages

dist/backend.js — derived-ast / parse
dist/backend.js — literal-decode / derivative-limit
dist/backend.js — normalize / derivative-limit
dist/backend.js — normalize / parse
dist/backend.js — normalize / unsupported
dist/frontend.js — derived-ast / parse
dist/frontend.js — literal-decode / derivative-limit
dist/frontend.js — normalize / derivative-limit
dist/frontend.js — normalize / parse
dist/frontend.js — normalize / unsupported
dist/frontend.js — raw-opengrep / parse
src/backend.ts — raw-ast / parse
src/backend.ts — raw-opengrep / parse
src/bus/block-repair.ts — raw-ast / parse
src/bus/extract.ts — derived-ast / parse
src/bus/extract.ts — normalize / parse
src/bus/extract.ts — raw-ast / parse
src/bus/lifecycle.ts — raw-ast / parse
src/bus/registry.ts — raw-ast / parse
src/bus/summarize.ts — derived-ast / parse
src/bus/summarize.ts — normalize / parse
src/bus/summarize.ts — raw-ast / parse
src/core/events.ts — raw-ast / parse
src/core/ids.ts — raw-ast / parse
src/core/migrate.ts — raw-ast / parse
src/core/palette.ts — raw-ast / parse
src/core/reduce.ts — raw-ast / parse
src/core/result.ts — raw-ast / parse
src/domain/aging.ts — raw-ast / parse
src/domain/beats.ts — raw-ast / parse
src/domain/cast-hygiene.ts — raw-ast / parse
src/domain/category-util.ts — raw-ast / parse
src/domain/category.ts — raw-ast / parse
src/domain/chapter-vault.ts — raw-ast / parse
src/domain/clock.ts — raw-ast / parse
src/domain/commands.ts — raw-ast / parse
src/domain/context-budget.ts — raw-ast / parse
src/domain/continuity.ts — raw-ast / parse
src/domain/core-feature.ts — raw-ast / parse
src/domain/date-format.ts — raw-ast / parse
src/domain/dialogue-colors.ts — raw-ast / parse
src/domain/directive.ts — raw-ast / parse
src/domain/drift.ts — raw-ast / parse
src/domain/fact-merge.ts — raw-ast / parse
src/domain/faction-vault.ts — raw-ast / parse
src/domain/identity.ts — derived-ast / parse
src/domain/identity.ts — normalize / unsupported
src/domain/identity.ts — raw-ast / parse
src/domain/locations.ts — raw-ast / parse
src/domain/markdown.ts — derived-ast / parse
src/domain/markdown.ts — normalize / parse
src/domain/markdown.ts — raw-ast / parse
src/domain/memory.ts — raw-ast / parse
src/domain/mood.ts — raw-ast / parse
src/domain/offscreen.ts — raw-ast / parse
src/domain/plants.ts — raw-ast / parse
src/domain/preset-budget.ts — raw-ast / parse
src/domain/preset-macro-lite.ts — raw-ast / parse
src/domain/promote.ts — raw-ast / parse
src/domain/relation-lock.ts — raw-ast / parse
src/domain/relations.ts — raw-ast / parse
src/domain/stats.ts — raw-ast / parse
src/domain/summarizer-config.ts — derived-ast / parse
src/domain/summarizer-config.ts — derived-opengrep / parse
src/domain/summarizer-config.ts — normalize / parse
src/domain/summarizer-config.ts — raw-ast / parse
src/domain/thread-catchup.ts — raw-ast / parse
src/domain/thread-merge.ts — raw-ast / parse
src/domain/tone.ts — raw-ast / parse
src/domain/turnlog.ts — raw-ast / parse
src/domain/types.ts — raw-ast / parse
src/domain/vault-intel.ts — literal-decode / binary
src/domain/vault-intel.ts — raw-ast / binary
src/domain/vault-intel.ts — raw-signatures / binary
src/domain/vault.ts — raw-ast / parse
src/host/capability.ts — raw-ast / parse
src/host/chats.ts — raw-ast / parse
src/host/generation.ts — raw-ast / parse
src/host/hide.ts — raw-ast / parse
src/host/presets.ts — raw-ast / parse
src/host/user.ts — raw-ast / parse
src/host/validation.ts — raw-ast / parse
src/host/worldbooks.ts — raw-ast / parse
src/parse/fallback-regex.ts — raw-ast / parse
src/parse/parsed.ts — raw-ast / parse
src/parse/state-block.ts — raw-ast / parse
src/retrieval/budget.ts — raw-ast / parse
src/retrieval/embed.ts — raw-ast / parse
src/retrieval/fuse.ts — raw-ast / parse
src/retrieval/invindex.ts — raw-ast / parse
src/retrieval/lexical.ts — raw-ast / parse
src/retrieval/recall.ts — raw-ast / parse
src/retrieval/tokenize.ts — raw-ast / parse
src/retrieval/traverse-tree.ts — derived-opengrep / parse
src/retrieval/traverse-tree.ts — raw-ast / parse
src/retrieval/traverse.ts — derived-opengrep / parse
src/retrieval/traverse.ts — raw-ast / parse
src/retrieval/tree.ts — raw-ast / parse
src/store/chronicle.ts — raw-ast / parse
src/store/import-legacy.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — completed
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: 69eca239911b7224e3fccc279902eb43cb583339
Completed: Aug 27, 2026
History depth: 20 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 3 fresh / 0 reused groups · 4 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 15 deterministic / 4 contextual candidates · 3 contextual / 7 total behavior cases
Model budget: 2 model calls · 3 / 12 fresh cases · 92377 / 200000 estimated input · 113237 / 250000 actual input · 3136 / 40000 output tokens
Review batching: 2 model calls · up to 2 groups and 2 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 113237 input · 3136 output · 46394 cache read · 0 reasoning tokens
Report: 3387f73d4dffed18e794955c029d5dfa690f9e2dc35521579f7d656a2f9b0755