TavernKeeper Scan Report

unrefined803/RPGraph

Commit afa7516 Reviewed Sep 6, 2026

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 44 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-regex
File role: production
Source: electron/main.cjs:2469

Deterministic technical evidence (16)

Dependency advisory GHSA-2v37-7h3g-55p8:pkg:c301f7c72c558e741e2a83a0 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-c83g-rgw3-j3cx:pkg:55c4a668cc988d5ceedbfbf6 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-8xcm-r25x-g524:pkg:9efcb22ccad71d16e9fbb4db applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-jqff-g426-hqxp:pkg:9d5a0ee915070fcb3b4f0f49 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-4cwx-7wf7-3272:pkg:1176429e737cfabdf766cdff applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-fph4-wmhf-6fwf:pkg:02097b1c123d52488af54cbe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-m8rv-5g2x-5cg5:pkg:effd824192445928106e41b7 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-5jgf-p345-68v8:pkg:0c0b4150b3480deab8a6ef16 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-f65p-4m7j-42xc:pkg:d8eaa1be485d9c348ff3a796 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-6gmq-8vp8-gcm6:pkg:71da7330fe763fba912b9efe applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-9f4c-93c8-jc8g:pkg:efaea3d20909e7a86cc5178e applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-r4w5-6pfg-jxp5:pkg:1b5485487a562a9e909542d7 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-73wf-gq98-2v4g:pkg:978489779fc1a775f3f91fab applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-p95v-992w-h6c3:pkg:5cae82464e421b021afa723a applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-v3r7-h72x-cjcm:pkg:2f99006f4e2ddba635fa3089 applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json
Dependency advisory GHSA-jr45-8vmc-qm54:pkg:ef6cbe09bba3516afec0221f applies · osv-scanner 2.4.0

A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

Policy reason: osv-structured-advisory · Execution scope: unknown

Source: package-lock.json

Contextual expected matches (26)

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line only arranges the buttons at the bottom of a small image-picking window inside the app. It is pure visual styling and cannot save anything, run anything, or change how the app or computer starts.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a stylesheet declaration that lays out the action button row of the application's profile-image picker dialog. It sets only visual layout properties. Stylesheet rules in this project contain no scripting, storage access, network calls, or startup hooks, so no startup-persistence behavior is possible at this location. The scanner match is a category false positive on presentational markup.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15944

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This is a line of visual styling for a pop-up image-picker window. Stylesheet lines cannot run programs or change how your computer starts up, so this match is a false alarm.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS style-sheet declaration inside a modal dialog rule block, part of a stylesheet shipped with the renderer UI. It contains no executable code, no script, no persistence mechanism, and no capability to modify startup behavior or system state. The scanner rule targeting startup persistence modification has matched stylesheet text, which cannot perform any of the behaviors the rule is designed to detect.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15852

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The script checks two simple settings to decide how to display test results. It does not copy, save, or send any environment data anywhere, so there is no secret-leaking risk.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The flagged lines read two environment variables to decide whether test output should be interactive or redirected to a local log file. Environment values are only compared against fixed literal strings and a boolean flag; nothing is copied into a serialized payload, transmitted, or persisted beyond a temporary local log that is deleted afterward. This is ordinary test-runner configuration with no credential or data flow to any destination.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: tooling
Source: scripts/run-tests.mjs:21

JavaScript analysis reported javascript.xray.data-exfiltration

Expected behavior · high confidence

The script asks the computer where its temporary folder is so it can store test logs there, then cleans them up. Nothing is sent outside your machine, so this is not data theft.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.data-exfiltration
File role: tooling
Source: scripts/run-tests.mjs:3

JavaScript analysis reported javascript.xray.unsafe-import

Expected behavior · high confidence

The script looks up where the installed testing tools live on your machine and runs them. It only allows two specific testing tools that are part of the project, so there is no hidden or risky code loading here.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-import. The match applies to this repository.

Contextual assessment: The flagged line resolves the local entrypoint file of one of two fixed test runners (vitest or playwright), both pinned devDependencies of this repository, and then spawns the project's own Node executable with that entrypoint. The module specifier comes from a hardcoded allow-listed map, not from user input, network data, or package metadata fetched at runtime. This is a standard, non-dynamic local test launcher with no supply-chain exposure demonstrated by the supplied code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-import
File role: tooling
Source: scripts/run-tests.mjs:23

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line only sets the size of a pop-up window in the app's interface. It cannot run anything or persist on your system, so there is no security issue.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is the opening selector of a CSS rule that styles a dialog element's width and height. It is static presentation markup with no executable semantics, no file or registry access, and no startup or persistence capability. A stylesheet declaration cannot implement the persistence behavior the scanner rule targets.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15830

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The scanner mistook a streaming-message keyword for a suspicious link. This file only prepares requests and read replies from the user's own model server; it never contacts any website or sends information anywhere.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged line belongs to a server-sent-event parser that dispatches on a leading data-field prefix to accumulate streaming payload lines. The full module only shapes request bodies for the local LM Studio integration and parses streamed replies; it contains no URL construction, network client, or outbound data flow. The scanner signal is a keyword false positive on the SSE field prefix, with no destination, timing, or disclosure concern.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: production
Source: electron/lmStudioChat.cjs:150

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line just controls how big the preview picture looks in a cropping window. It changes nothing except appearance and cannot affect anything outside that window.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line begins a rule that sizes and fits the preview image shown inside the profile-image crop dialog. It declares only display and sizing values. CSS declarations here have no executable capability, no data flow, and no persistence or startup mechanism, so the matched persistence rule does not correspond to any behavior in the supplied code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15888

JavaScript analysis reported javascript.xray.data-exfiltration

Expected behavior · high confidence

The scanner reacted to a routine system-information import. The visible code communicates only with the model services the user sets up, which is the app's stated purpose; nothing sends your keys, stories, or machine details anywhere unexpected.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.data-exfiltration. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.data-exfiltration
File role: production
Source: electron/main.cjs:8

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

A test runs the app's own bridge code in an isolated bubble with fake Electron parts to check that it behaves correctly. It only ever executes the project's own code during automated testing, so there is no way for an attacker or outside input to use it.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.

Contextual assessment: The flagged construct executes the project's own committed preload bridge script inside a VM context with stubbed Electron globals so unit tests can verify IPC cancellation and provider error propagation. The only code executed is first-party, file-resident source read from the repository itself; no untrusted, user-supplied, or remote input reaches the execution call, and the file is test scaffolding that does not ship in the application's runtime path.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.dynamic-execution.javascript-eval
File role: test
Source: electron/providerModelLists.test.ts:10-15

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line styles the box that holds a picture while the user crops it. It is ordinary appearance code with no power to run, save, or change anything on its own.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line begins a rule styling the container that holds the image in the profile-image crop dialog, setting only positioning and interaction hint properties. A stylesheet declaration cannot register startup execution, write persistent state, or originate any data flow, so no persistence exposure is demonstrated by this evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15879

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This is more pop-up styling, deciding how an image area is laid out. Styles cannot start programs or persist, so this is a false positive.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS rule for a layout stage element inside the same character profile picker styling block. It declares grid layout, overflow, borders, and background colors. There is no code execution, no persistence, and no state modification of any kind; the scanner rule for startup persistence modification cannot be satisfied by stylesheet text.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15862

JavaScript analysis reported javascript.xray.unsafe-command

Expected behavior · high confidence

When you install the project, this helper tells git to use the project's own commit-check scripts. It runs two fixed, well-known git commands, changes nothing outside the project folder, and does nothing at all when git is absent. This is a common, harmless setup step.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-command. The match applies to this repository.

Contextual assessment: The flagged calls execute two fully hardcoded git commands: one read-only check for whether the current directory is a git work tree, and one local repository configuration change that points git at the tracked hooks directory inside the same repository. Neither command contains interpolation, user input, network access, or out-of-repo modification. The script runs as an npm prepare step, is guarded by a try/catch no-op outside a repository, and modifies only the local clone's git config. This is a widely used, disclosed pattern for installing committed git hooks and does not create system persistence or code execution beyond the developer's own checkout.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.unsafe-command
File role: tooling
Source: scripts/setup-git-hooks.mjs:8-10

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line only changes the mouse pointer shape while you drag the cropping circle. It is cosmetic and cannot do anything beyond how the app looks.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is an interaction-state rule that changes the mouse pointer shown while the crop ring in the profile-image dialog is being dragged. It only sets a cursor appearance. There is no execution, persistence, network, or file activity possible in this declaration, so the persistence-category match reflects no actual behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15918

JavaScript analysis reported javascript.xray.serialize-environment

Expected behavior · high confidence

The script copies the program's settings list so it can hand them to the app it starts on your own computer. Nothing is sent anywhere else. This is a normal way to start the desktop app and does not expose any secrets.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.

Contextual assessment: The flagged line copies the current process environment into a plain object solely to remove one Electron-specific variable before spawning the local Electron binary as a child process. This is a standard launcher pattern: the environment is passed to the project's own child process and never serialized to disk, logged, or sent to any external destination. The spread copies the environment locally within the same machine and process tree; there is no exfiltration path or attacker-controlled data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.serialize-environment
File role: tooling
Source: scripts/run-electron.mjs:7

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

A styling line that removes spacing around text in a pop-up header. It cannot do anything harmful.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS element selector that resets margins for headings and paragraphs inside a dialog header. It is inert presentation markup with no executable or persistent behavior; the startup-modification scanner rule is not applicable to stylesheet content.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15853

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line makes the cropping circle in the image picker look the way it does. It is styling only and has no ability to run or store anything.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line begins a rule that visually styles the draggable circular crop overlay in the profile-image dialog, defining borders, shape, shadow, and pointer hints. It is presentational only; a stylesheet declaration cannot perform startup modification or persistence, and the supplied context shows no executable code at or near this line.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15902

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line draws the faint dashed ring inside the cropping circle so the user can see the crop area. It is purely cosmetic.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line begins a rule drawing the dashed inner guide inside the crop ring of the profile-image dialog, setting only position, border, and pointer-pass-through values. No code execution, data flow, or persistence capability exists in this declaration, so the startup-persistence rule category does not match the actual content.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15922

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line styles the little round handle used to make the crop circle bigger or smaller. It only affects how that handle looks and feels.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line begins a rule styling the small resize knob on the crop overlay in the profile-image dialog, defining its placement, size, shape, colors, and resize pointer. It is purely presentational; no startup modification, storage, network, or execution path exists at this location in the supplied evidence.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15930

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

A line that colors and sizes a pop-up title. Harmless styling, not a startup change.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS heading selector setting text color and size in the profile picker dialog. It is static styling with no code, data flow, or persistence capability; the matched scanner rule describes executable startup modification, which stylesheet text cannot perform.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15857

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

A tiny fake image used in an automated test was mistaken for a suspicious link. It exists only inside the test and never leaves the developer's machine or affects app users.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The flagged literals are inline placeholder image data URIs used as unit-test fixtures to verify multimodal request construction. They are never transmitted, the containing file is test scaffolding rather than shipped runtime code, and there is no network destination or credential involvement anywhere in the file.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: test
Source: electron/lmStudioChat.test.ts:69

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

Styling that dims the background behind a pop-up window inside the app. It only affects what you see on screen and cannot change anything on your system.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line opens a CSS rule for a full-screen backdrop behind a modal dialog, declaring fixed positioning, z-index, flex centering, and a translucent background. This positions an overlay within the app's web view only; it does not touch the operating system, autorun locations, or any persistence mechanism. The scanner's startup-persistence rule matched static stylesheet keywords, not executable behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15819

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

Layout styling for a pop-up header. Purely visual, with no ability to run or persist anything.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line is a CSS rule laying out a dialog header with flexbox, gap, padding, and a bottom border. It is inert markup for visual presentation with no executable code or persistence behavior; the matched scanner rule cannot apply to stylesheet declarations.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15843

JavaScript analysis reported javascript.xray.shady-link

Expected behavior · high confidence

The flagged web addresses are the standard local addresses of the user's own model programs running on the same computer, which is exactly what this local-first desktop app is built to connect to. There is no hidden external destination.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.

Contextual assessment: The occurrences correspond to plain-HTTP default addresses for loopback model and image services, a local development-server address, and user-configurable base URLs, matching the project's documented local-first architecture. The ComfyUI URL handling explicitly restricts protocols, and destinations default to the user's own machine rather than any concealed external host. Non-TLS loopback defaults are normal for local inference servers, which typically do not terminate TLS.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule: javascript.xray.shady-link
File role: production
Source: electron/main.cjs:50

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

More pop-up styling for the image area. It cannot run code or change startup behavior.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line opens a CSS rule for the image-stage element of the same picker dialog, containing grid and box styling only. As with the other candidates in this stylesheet block, there is no executable code, no data flow, and no persistence capability, so the startup-modification rule match is a textual false positive against presentation markup.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15868

OpenGrep reported tavernkeeper.persistence.startup-modification

Expected behavior · high confidence

This line slightly darkens the area around the cropping circle so the crop region stands out. It is a visual effect and nothing more.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.persistence.startup-modification. The match applies to this repository.

Contextual assessment: The flagged line begins a rule creating the dimming overlay behind the crop ring in the profile-image dialog, setting only positioning and a translucent background. A stylesheet declaration has no capability to persist state or modify startup behavior, so this scanner match does not correspond to any demonstrated exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner: opengrep 1.26.0
Rule: tavernkeeper.persistence.startup-modification
File role: production
Source: src/styles.css:15895

Related contextual observations

Startup-persistence scanner rule matched purely presentational stylesheet rules

low risk · high confidence

A scanning tool flagged these lines as suspicious startup-related behavior, but the lines only describe how a picture-cropping window looks in the app. Styling code cannot run programs, save data, or change how the computer starts up, so nothing harmful is present.

Technical assessment

All eight candidates point into a contiguous block of stylesheet rules that define the look of an in-app profile-image cropping dialog: the image frame, preview image sizing, dimming overlay, draggable crop ring, its active-state pointer, inner guide, resize knob, and the button row. Every flagged line contains only visual declarations. Stylesheets in this project carry no script execution, storage access, network requests, or startup registration, so a persistence/startup-modification rule cannot correspond to real behavior here; the matches appear to be pattern-driven false positives on styling keywords.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Inventory: 403 files · 24971051 bytes
Contextual coverage: 43 of 43 candidates assessed

JavaScript coverage

Status: Incomplete
Candidates: 327 files · 3973508 bytes
X-Ray review families: 23 warning occurrences compacted to 10 evidence-preserving review families
Representations: 327 raw · 20 decoded · 2 normalized · 0 bundle modules
Stage scans: 327 raw signatures · 33 raw AST · 327 raw OpenGrep · 22 derived signatures · 4 derived AST · 22 derived OpenGrep

Unresolved JavaScript stages

electron/providerModelLists.test.ts — raw-ast / parse
electron/workflowDefaults.test.ts — raw-ast / parse
src/App.tsx — raw-ast / parse
src/app/debugSnapshot.test.ts — raw-ast / parse
src/app/debugSnapshot.ts — raw-ast / parse
src/app/providerCapabilities.ts — raw-ast / parse
src/app/runOrchestration.ts — raw-ast / parse
src/app/turnTrace.test.ts — raw-ast / parse
src/app/turnTrace.ts — raw-ast / parse
src/app/useCustomNodeAssistant.ts — raw-ast / parse
src/app/useDirectAppActions.ts — raw-ast / parse
src/app/useGraphRun.ts — raw-ast / parse
src/app/useNodeActionsController.ts — raw-ast / parse
src/app/useNodeContextMenu.ts — raw-ast / parse
src/app/useNodeLlmApi.ts — raw-ast / parse
src/app/useNodePalette.ts — raw-ast / parse
src/app/useProviderConnections.test.ts — raw-ast / parse
src/app/useProviderConnections.ts — raw-ast / parse
src/app/useRoleplayPanelRuntime.ts — raw-ast / parse
src/app/useRpgraphFiles.ts — raw-ast / parse
src/app/useRunLifecycle.ts — raw-ast / parse
src/app/useRuntimeNodePatching.ts — raw-ast / parse
src/app/useTurnTraceState.ts — raw-ast / parse
src/app/useUiScaling.ts — raw-ast / parse
src/app/useWorkflowCapabilities.ts — raw-ast / parse
src/app/useWorkflowVariables.ts — raw-ast / parse
src/app/workflowHydration.test.ts — raw-ast / parse
src/app/workflowHydration.ts — raw-ast / parse
src/app/workflowSnapshot.ts — raw-ast / parse
src/assistant/workflowSnapshot.ts — raw-ast / parse
src/chat/AutoplayControl.tsx — raw-ast / parse
src/chat/PhoneTab.tsx — raw-ast / parse
src/chat/RunProgressCard.tsx — raw-ast / parse
src/chat/VoicePlaybackDialog.tsx — raw-ast / parse
src/chat/bankTransfers.ts — raw-ast / parse
src/chat/bankingDummyTransactions.ts — raw-ast / parse
src/chat/dialogueVoiceSegments.ts — raw-ast / parse
src/chat/directAppActions.ts — raw-ast / parse
src/chat/imageGenerationAssistant.ts — raw-ast / parse
src/chat/inputTransforms.ts — raw-ast / parse
src/chat/instructions.ts — raw-ast / parse
src/chat/messageFormats.ts — raw-ast / parse
src/chat/onlyFriendsWallet.ts — raw-ast / parse
src/chat/outputActions.ts — raw-ast / parse
src/chat/phoneAppHistoryMessages.ts — raw-ast / parse
src/chat/phoneAppsSessions.ts — raw-ast / parse
src/chat/phoneCharacters.ts — raw-ast / parse
src/chat/phoneMessages.ts — raw-ast / parse
src/chat/phoneReplies.ts — raw-ast / parse
src/chat/referenceImages.ts — raw-ast / parse
src/chat/rpOutput.ts — raw-ast / parse
src/chat/rpPictures.ts — raw-ast / parse
src/chat/socialCatalogs.ts — raw-ast / parse
src/chat/socialDirectory.ts — raw-ast / parse
src/chat/socialIdentity.test.ts — raw-ast / parse
src/chat/socialMedia.ts — raw-ast / parse
src/chat/socialMessageValidation.ts — raw-ast / parse
src/chat/structuredCommands.ts — raw-ast / parse
src/chat/textRendering.ts — raw-ast / parse
src/chat/translationEmojiShield.ts — raw-ast / parse
src/chat/ttsNarratorPrompt.ts — raw-ast / parse
src/chat/turns.test.ts — raw-ast / parse
src/chat/turns.ts — raw-ast / parse
src/chat/useAutoplay.ts — raw-ast / parse
src/chat/useChatGpdPhoneApp.ts — raw-ast / parse
src/chat/useDialogueVoice.ts — raw-ast / parse
src/chat/useNextTurnReferenceImages.ts — raw-ast / parse
src/chat/usePhoneReply.ts — raw-ast / parse
src/chat/useTurnRecordState.ts — raw-ast / parse
src/comfy/ComfyGeneratedImageDialog.tsx — raw-ast / parse
src/comfy/api.ts — raw-ast / parse
src/comfy/connectionRole.ts — raw-ast / parse
src/comfy/defaultNarratorVoice.ts — raw-ast / parse
src/comfy/workflowCompatibility.ts — raw-ast / parse
src/components/AppDialogs.tsx — raw-ast / parse
src/components/AssistantDialog.tsx — raw-ast / parse
src/components/BankTransferCard.tsx — raw-ast / parse
src/components/CharacterAvatar.tsx — raw-ast / parse
src/components/ChatConversationPanel.tsx — raw-ast / parse
src/components/CommandPillComposer.tsx — raw-ast / parse
src/components/CreatedPhoneNoteCard.tsx — raw-ast / parse
src/components/DarkAudioPlayer.tsx — raw-ast / parse
src/components/EdgeCharacterPicker.tsx — raw-ast / parse
src/components/ErrorBoundary.tsx — raw-ast / parse
src/components/EventsPanel.tsx — raw-ast / parse
src/components/ImageContextControl.tsx — raw-ast / parse
src/components/ImageGenerationAssistantDialog.tsx — raw-ast / parse
src/components/LiveRunClock.tsx — raw-ast / parse
src/components/ModelIdPicker.tsx — raw-ast / parse
src/components/PhoneBankingScreen.tsx — raw-ast / parse
src/components/PhoneChatGpdScreen.tsx — raw-ast / parse
src/components/PhoneGalleryScreen.tsx — raw-ast / parse
src/components/PhoneImagePicker.tsx — raw-ast / parse
src/components/PhoneNotesScreen.tsx — raw-ast / parse
src/components/PhonePanel.tsx — raw-ast / parse
src/components/PhoneVoiceMessage.tsx — raw-ast / parse
src/components/PromptPresetOverview.tsx — raw-ast / parse
src/components/ResourceMonitor.tsx — raw-ast / parse
src/components/SimulatedAiChatCard.tsx — raw-ast / parse
src/components/SocialPostCard.tsx — raw-ast / parse

Tools

inventory 0.1.0 — completed
tavernkeeper-static 5 — completed
gitleaks 8.30.1 — completed
opengrep 1.26.0 — completed
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
osv-scanner 2.4.0 — completed
zizmor 1.28.0 — not-applicable
malcontent 1.25.7 — completed

Limitations

This advisory review cannot prove the absence of unknown behavior.
JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.

Technical scan identity

Full commit: afa75164a83f12b72f25f3469f5a28b22f9cecfc
Completed: Sep 6, 2026
History depth: 12 commits
Method: Deterministic evidence with contextual review
Reviewer: nano-gpt.com · zai-org/glm-latest
Scanner: 0.1.0
Scanner policy: 5
Rule catalog: 2
Contextual policy: 5
Ecosystem context: sillytavern-community-v1
Prompt: contextual-review-v7
Assessment schema: contextual-assessment-v2
Review provenance: 9 fresh / 0 reused groups · 26 fresh / 0 reused candidates
Review source reports: none
Evidence triage: 17 deterministic / 26 contextual candidates · 9 contextual / 12 total behavior cases
Model budget: 3 model calls · 9 / 12 fresh cases · 128833 / 200000 estimated input · 104586 / 250000 actual input · 14509 / 40000 output tokens
Review batching: 3 model calls · up to 4 groups and 13 candidates per call · 0 retry calls · 0 over-budget singleton calls
Review usage: 104586 input · 14509 output · 1344 cache read · 5679 reasoning tokens
Report: 970b065efe033139b151c534848ec321106764784e177b9609e0f1b53cbaa75a