TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

XaYS-101/Backup-Cleaner-Silly-Tavern

Commit 6b6ad3f Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
util.js:8

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
i18n.js:309

Coverage and limitations

Inventory
13 files · 129211 bytes
Contextual coverage
2 of 2 candidates assessed

JavaScript coverage

Status
Complete
Candidates
7 files · 101895 bytes
X-Ray review families
2 warning occurrences compacted to 2 evidence-preserving review families
Representations
7 raw · 0 decoded · 0 normalized · 0 bundle modules
Stage scans
7 raw signatures · 7 raw AST · 7 raw OpenGrep · 0 derived signatures · 0 derived AST · 0 derived OpenGrep

Tools

Limitations

Technical scan identity
Full commit
6b6ad3f6aaaa8246f6ff4a81b3f2c220e035880f
Completed
History depth
3 commits
Method
Deterministic evidence with contextual review
Reviewer
Not used — deterministic policy
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
0 fresh / 0 reused groups · 0 fresh / 0 reused candidates
Review source reports
none
Evidence triage
2 deterministic / 0 contextual candidates · 0 contextual / 2 total behavior cases
Model budget
0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage
0 input · 0 output · 0 cache read · 0 reasoning tokens
Report
828348ef848fbd928deb8ef1e638e09e59b98ffb71197512897d1d3bdda3abd7