TavernKeeper Scan Report

N0819/Sonder_Engine

Commit c0d9276 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 9 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (3)
  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:77

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:38

  • zizmor reported artipacked · zizmor 1.28.0

    The code has a known weakness, though this scan does not show that anyone can exploit it here.

    Policy reason: zizmor-known-workflow-rule · Execution scope: automation

    Source: .github/workflows/ci.yml:115

Contextual expected matches (6)

Gitleaks reported generic-api-key

Expected behavior · high confidence

An automated secret scanner saw a word that looks like how API keys are often named and raised a flag. In this code the word is just the internal name of a character in the game's bookkeeping, and nothing in the file touches passwords, tokens, or online accounts. There is no secret here and nothing at risk.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The flagged line is inside a pure in-memory scene-summary routine that assembles a per-character dictionary for the story simulation. The token the secret scanner matched is a local Python variable holding a character/body identifier, passed as an argument to a view helper alongside a bounded result cap. The surrounding function only reads existing world-state dictionaries and returns derived data; the entire supplied context contains no secret value assignment, environment read, credential store, or network destination. The generic-api-key rule is an entropy/pattern heuristic that reacted to the identifier naming convention, not to any credential.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
world/charter_log.py:383

Gitleaks reported generic-api-key

Expected behavior · high confidence

An automated secret scanner saw the everyday word 'key' being used as a name for a character in the game's code and guessed it was an API key. Reading the actual line, it is ordinary game logic that summarizes what a character thinks about the people around them. No password, token, or key of any kind is present.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The supplied source window fully covers the flagged line. It is an argument list inside a per-presence scene ledger builder: a dictionary of in-game relationship data is passed to a helper that produces a capped per-character view, alongside the character's own identifier and a numeric limit. The line contains no literal resembling a credential — only variable references, set arithmetic, and a small integer cap. The generic pattern matcher appears to have keyed on the common word used as the loop variable for a character body combined with an assignment-like token, which is a known false-positive shape for this rule. No secret value, destination, or credential data flow exists at this location.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
world/charter_log.py:383

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is the same mistake by the scanner on a neighboring line: it mistook the internal name of a character for an API key. The code only builds a description of the scene for the game; it never handles real secrets.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: This flag sits two lines above the other match, in the same dictionary construction, and is the same false positive: the matched token is the local character-identifier variable passed to a judgment-summary helper with a bounded cap. No credential literal, secret assignment, or credential-consuming call exists anywhere in the supplied module context; the file is simulation state derivation only.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
world/charter_log.py:381

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

A scanner flagged the file as possibly 'obfuscated', meaning deliberately scrambled to hide what it does. The code shown is the opposite: ordinary, well-commented settings-screen code where every button and dialog is visible and self-explanatory. Nothing is hidden.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.

Contextual assessment: The supplied source, including the line the signal points at (a plain section comment) and an extensive window into the rest of the file, is readable, comment-rich browser script that builds settings dialogs for the local application: world-state, attire, style-guide, language, and dialogue-configuration editors. It contains no encoded strings, no string-array indirection, no dynamic code evaluation, and no concealed second layer of behavior. All data calls target the application's own backend routes for story configuration, matching the project's stated purpose. The obfuscation signal, reported at low scanner confidence, does not correspond to any concealment technique visible in the code; such heuristics commonly misfire on dense, idiomatically written UI code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
static/js/settings.js:1

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is the same false alarm on the neighboring line: the scanner mistook the word 'key', used here as a label for a character, for a secret API key. The line just records which promises a character knows about. Nothing secret is stored or sent anywhere.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.

Contextual assessment: The supplied source window fully covers the flagged line, two lines below the other flagged candidate. It is the same kind of site: an in-game commitments structure is passed to a helper that builds a capped, per-character view of only the commitments that body is party to. The line consists of variable references, set arithmetic, and a numeric cap; it contains no credential literal and no data leaving the process. The match is the same generic-pattern false positive triggered by the character-identifier variable name, not a demonstrated exposure.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
world/charter_log.py:381

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner worried that a text-search pattern might be written so poorly that a crafted message could hang the app. This one is built from simple, non-overlapping pieces that cannot loop explosively, and it only affects how story text is highlighted in the local window.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The flagged pattern is a case-insensitive regular expression used to find a closed list of emphasis tag names, plus an optional color-word attribute, inside narrated prose before rendering. Structurally it is a literal prefix, an alternation of distinct fixed tag names, and one greedy character-range group terminated by a literal quote; it contains no nested or mutually ambiguous quantifiers, so there is no catastrophic-backtracking construction and matching cost stays effectively linear in input length. The surrounding renderer also deliberately creates DOM nodes directly rather than parsing model output as HTML, so this pattern cannot convert prose into executable markup. The unsafe-regex signal is a heuristic false positive; even a worst-case input would at most mildly slow local rendering of one turn, which is not a meaningful harm under this threat model.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
static/js/chat.js:234

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity