TavernKeeper Scan Report

Beeopo/Lumiverse-Rewrite

Commit b4007cc Reviewed Aug 10, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 1 low

What this review found

No material or immediate-danger item was identified.

Expected scanner matches (1)

JavaScript analysis reported javascript.xray.short-identifiers

Expected behavior · high confidence

This is a false alarm. The code uses short variable names because it has been minified to make it load faster. That's normal for distributed software, not a sign of hiding anything bad.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.short-identifiers in this repository.

Contextual assessment: The file file is a minified JavaScript bundle generated by Bun's build command with the --minify flag (as declared in package.json). Minification produces short variable names as a size optimization, which triggers the 'short-identifiers' signal. No actual obfuscation, concealed execution, or malicious intent is present. The code's functionality, structure, and data flows match the project's stated purpose and are transparent in pre-minified source.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule: javascript.xray.short-identifiers
File role: generated
Source: dist/backend.js:1

Coverage and limitations

Inventory: 26 files · 291139 bytes
Contextual coverage: 1 of 1 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 18 files · 272995 bytes
Representations: 18 raw · 11 decoded · 1 normalized · 0 bundle modules
Stage scans: 18 raw signatures · 7 raw AST · 18 raw OpenGrep · 12 derived signatures · 1 derived AST · 12 derived OpenGrep

Unresolved JavaScript stages

dist/backend.js — derived-ast / parse
dist/backend.js — normalize / parse
dist/frontend.js — derived-ast / parse
dist/frontend.js — normalize / parse
src/align.test.ts — raw-ast / parse
src/align.ts — raw-ast / parse
src/backend.ts — raw-ast / parse
src/context-blocks.test.ts — raw-ast / parse
src/frontend.ts — raw-ast / parse
src/profiles.test.ts — raw-ast / parse
src/profiles.ts — raw-ast / parse
src/quotes.ts — raw-ast / parse
src/settings-io.ts — raw-ast / parse
src/types.ts — raw-ast / parse
src/wc.ts — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 4 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — not-applicable

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: b4007ccf738a719dbc64fd8e2880451cae0adb09
Completed: Aug 10, 2026
History depth: 7 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · deepseek/deepseek-v4-flash:thinking
Scanner: 0.1.0
Scanner policy: 4
Rule catalog: 1
Contextual policy: 3
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v6
Assessment schema: contextual-assessment-v2
Review usage: 9446 input · 767 output · 0 cache read · 0 reasoning tokens
Report: 104890a19c67dc3c153c15ea96f3d231a979861d8d39e59ebca757bdbe123f13