An automated secret scanner saw a word that looks like how API keys are often named and raised a flag. In this code the word is just the internal name of a character in the game's bookkeeping, and nothing in the file touches passwords, tokens, or online accounts. There is no secret here and nothing at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is inside a pure in-memory scene-summary routine that assembles a per-character dictionary for the story simulation. The token the secret scanner matched is a local Python variable holding a character/body identifier, passed as an argument to a view helper alongside a bounded result cap. The surrounding function only reads existing world-state dictionaries and returns derived data; the entire supplied context contains no secret value assignment, environment read, credential store, or network destination. The generic-api-key rule is an entropy/pattern heuristic that reacted to the identifier naming convention, not to any credential.
An automated secret scanner saw the everyday word 'key' being used as a name for a character in the game's code and guessed it was an API key. Reading the actual line, it is ordinary game logic that summarizes what a character thinks about the people around them. No password, token, or key of any kind is present.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The supplied source window fully covers the flagged line. It is an argument list inside a per-presence scene ledger builder: a dictionary of in-game relationship data is passed to a helper that produces a capped per-character view, alongside the character's own identifier and a numeric limit. The line contains no literal resembling a credential — only variable references, set arithmetic, and a small integer cap. The generic pattern matcher appears to have keyed on the common word used as the loop variable for a character body combined with an assignment-like token, which is a known false-positive shape for this rule. No secret value, destination, or credential data flow exists at this location.
This is the same mistake by the scanner on a neighboring line: it mistook the internal name of a character for an API key. The code only builds a description of the scene for the game; it never handles real secrets.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: This flag sits two lines above the other match, in the same dictionary construction, and is the same false positive: the matched token is the local character-identifier variable passed to a judgment-summary helper with a bounded cap. No credential literal, secret assignment, or credential-consuming call exists anywhere in the supplied module context; the file is simulation state derivation only.
A scanner flagged the file as possibly 'obfuscated', meaning deliberately scrambled to hide what it does. The code shown is the opposite: ordinary, well-commented settings-screen code where every button and dialog is visible and self-explanatory. Nothing is hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The supplied source, including the line the signal points at (a plain section comment) and an extensive window into the rest of the file, is readable, comment-rich browser script that builds settings dialogs for the local application: world-state, attire, style-guide, language, and dialogue-configuration editors. It contains no encoded strings, no string-array indirection, no dynamic code evaluation, and no concealed second layer of behavior. All data calls target the application's own backend routes for story configuration, matching the project's stated purpose. The obfuscation signal, reported at low scanner confidence, does not correspond to any concealment technique visible in the code; such heuristics commonly misfire on dense, idiomatically written UI code.
This is the same false alarm on the neighboring line: the scanner mistook the word 'key', used here as a label for a character, for a secret API key. The line just records which promises a character knows about. Nothing secret is stored or sent anywhere.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The supplied source window fully covers the flagged line, two lines below the other flagged candidate. It is the same kind of site: an in-game commitments structure is passed to a helper that builds a capped, per-character view of only the commitments that body is party to. The line consists of variable references, set arithmetic, and a numeric cap; it contains no credential literal and no data leaving the process. The match is the same generic-pattern false positive triggered by the character-identifier variable name, not a demonstrated exposure.
The scanner worried that a text-search pattern might be written so poorly that a crafted message could hang the app. This one is built from simple, non-overlapping pieces that cannot loop explosively, and it only affects how story text is highlighted in the local window.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged pattern is a case-insensitive regular expression used to find a closed list of emphasis tag names, plus an optional color-word attribute, inside narrated prose before rendering. Structurally it is a literal prefix, an alternation of distinct fixed tag names, and one greedy character-range group terminated by a literal quote; it contains no nested or mutually ambiguous quantifiers, so there is no catastrophic-backtracking construction and matching cost stays effectively linear in input length. The surrounding renderer also deliberately creates DOM nodes directly rather than parsing model output as HTML, so this pattern cannot convert prose into executable markup. The unsafe-regex signal is a heuristic false positive; even a worst-case input would at most mildly slow local rendering of one turn, which is not a meaningful harm under this threat model.