TavernKeeper Scan Report

maxime-fleury/ST-cardEditor

Commit 2550e36 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 4 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

zizmor reported unpinned-uses

Minor caution · high confidence

The deployment step uses a version label for a third-party GitHub Action that has write access to the repository. If that label were ever redirected to malicious code, it could abuse that access. Pinning to an exact snapshot would prevent this, though the risk is low given the trigger conditions.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The gh-pages deployment action is pinned to a major-version floating tag. This action receives the GITHUB_TOKEN with contents:write permission to push to the gh-pages branch. A tag rewrite to a malicious commit could abuse that token. The workflow trigger is limited to push events on master/dev and manual dispatch, so exploitation requires compromising the action's upstream tag. Full-SHA pinning would close this gap.

Impact: low · Exploitability: unlikely

Developer action: Pin peaceiris/actions-gh-pages to a full commit SHA for reproducibility and tag-rewrite resistance.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/deploy.yml:72

zizmor reported unpinned-uses

Minor caution · high confidence

The workflow uses a version label for a GitHub Action that could theoretically be changed to point at different code. Pinning to an exact code snapshot would be safer, but the current setup is extremely common and only runs when project maintainers push code.

Technical evidence

Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.

Contextual assessment: The checkout action is pinned to a major-version floating tag rather than a full commit SHA. If the tag were ever moved to a malicious commit, the workflow would execute untrusted code with the repository's GITHUB_TOKEN. The workflow only triggers on push to master/dev or manual dispatch, limiting exposure to maintainer-initiated runs. Pinning to a full SHA would eliminate the tag-rewrite risk.

Impact: low · Exploitability: unlikely

Developer action: Pin actions/checkout to a full commit SHA for reproducibility and tag-rewrite resistance.

Scanner
zizmor 1.28.0
Rule
unpinned-uses
File role
tooling
Source
.github/workflows/deploy.yml:29

zizmor reported artipacked

Minor caution · medium confidence

The checkout step stores a temporary access token in the build machine's git configuration by default. This is only a problem if that configuration is saved and shared, which this workflow never does. The token disappears when the temporary build machine shuts down.

Technical evidence

Scanner reason: zizmor matched workflow-security rule artipacked in this repository.

Contextual assessment: The checkout action defaults to persist-credentials true, storing the GITHUB_TOKEN in the local git config. The artipacked pattern is only exploitable when the .git directory or credential-bearing files are uploaded as artifacts. This workflow never uploads artifacts; the deploy tree is built from git archive output, which excludes .git entirely. The persisted credential remains local to the ephemeral runner and is discarded at job termination. Setting persist-credentials false would be cleaner but the current code has no reachable credential-exposure path.

Impact: low · Exploitability: unlikely

Developer action: Set persist-credentials: false on the checkout step to avoid unnecessary credential persistence, though no exposure path exists in the current workflow.

Scanner
zizmor 1.28.0
Rule
artipacked
File role
tooling
Source
.github/workflows/deploy.yml:28-31
Expected scanner matches (1)

OpenGrep reported tavernkeeper.download-and-execute.shell-pipeline

Expected behavior · high confidence

The flagged line is just the normal instruction in the project's readme telling users how to install the Bun runtime, using the official Bun installer. It is not part of the application and does not run automatically.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline in this repository.

Contextual assessment: The matched pattern is a standard shell-pipe installation instruction in a README documentation file, instructing users to install the Bun runtime from its official source. This is not executable code within the project itself; it is a documented prerequisite command that users run manually. The URL is the official Bun installer endpoint and the command is a widely recognized convention. No concealed execution, obfuscation, or unexpected destination is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.download-and-execute.shell-pipeline
File role
documentation
Source
README.md:184-185

Coverage and limitations

Tools

Limitations

Technical scan identity