TavernKeeper Scan Report
Archkr/Lumiverse-LumiMind
Commit 02bf70d Reviewed
No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger 0 material 4 low
What this review found
No material or immediate-danger item was identified.
Deterministic technical evidence (4)
-
Dependency advisory GHSA-82fw-gwwq-j7x9:pkg:e73b265e463302d69e55909b applies · osv-scanner 2.4.0
A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.
Policy reason:
osv-structured-advisory· Execution scope: unknownSource: bun.lock
-
Dependency advisory GHSA-82fw-gwwq-j7x9:pkg:00f885f51d12cc13a66b964f applies · osv-scanner 2.4.0
A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.
Policy reason:
osv-structured-advisory· Execution scope: unknownSource: bun.lock
-
Dependency advisory GHSA-2v37-7h3g-55p8:pkg:c301f7c72c558e741e2a83a0 applies · osv-scanner 2.4.0
A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.
Policy reason:
osv-structured-advisory· Execution scope: unknownSource: bun.lock
-
Dependency advisory GHSA-fxqj-rqcc-2cmp:pkg:f94edd69deef3d5effba7f8b applies · osv-scanner 2.4.0
A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.
Policy reason:
osv-structured-advisory· Execution scope: unknownSource: bun.lock
Coverage and limitations
JavaScript coverage
Unresolved JavaScript stages
src/backend.test.ts— raw-ast / parsesrc/backend.ts— raw-ast / parsesrc/controller-fallbacks.test.ts— raw-ast / parsesrc/controller-operations.test.ts— raw-ast / parsesrc/controller-requests.test.ts— raw-ast / parsesrc/controller-requests.ts— raw-ast / parsesrc/controller-scheduling.test.ts— raw-ast / parsesrc/controller-scheduling.ts— raw-ast / parsesrc/controller.test.ts— raw-ast / parsesrc/controller.ts— raw-ast / parsesrc/diagnostics.ts— raw-ast / parsesrc/engine.test.ts— raw-ast / parsesrc/engine.ts— raw-ast / parsesrc/frontend.ts— raw-ast / parsesrc/injection.test.ts— raw-ast / parsesrc/injection.ts— raw-ast / parsesrc/lumi-state.ts— raw-ast / parsesrc/repair.test.ts— raw-ast / parsesrc/repair.ts— raw-ast / parsesrc/storage.ts— raw-ast / parsesrc/tidy.ts— raw-ast / parsesrc/types.ts— raw-ast / parsesrc/ui/helpers.test.ts— raw-ast / parsesrc/ui/helpers.ts— raw-ast / parse
Tools
- inventory 0.1.0 — completed
- tavernkeeper-static 5 — completed
- gitleaks 8.30.1 — completed
- opengrep 1.26.0 — completed
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1 — completed
- osv-scanner 2.4.0 — completed
- zizmor 1.28.0 — not-applicable
- malcontent 1.25.7 — not-applicable
Limitations
- This advisory review cannot prove the absence of unknown behavior.
- JavaScript analysis was incomplete, so this first-filter scan supports no clean conclusion about unobserved behavior.