No material or immediate-danger item was identified.
Expected scanner matches (37)
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret. No code executes it and it grants no privileged access beyond viewing the screenshot.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:134
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:155
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a build-time helper script used by developers to extract configuration presets from an old reference file and save them as JSON. It uses a JavaScript feature that can run code dynamically, but the only code it runs comes from a file already committed in the repository, not from anything a user or attacker can control. It is not included in the plugin that users install.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `Function` constructor is inside a developer-only build tool that reads a committed reference file from the repository, slices named object/array literals by brace/bracket balance, and evaluates those slices to serialize them as JSON config files. The evaluated text originates solely from a vendored reference source file under version control, not from user input, network data, or runtime configuration. The script runs only during development/build and is not part of the shipped plugin bundle. This is a pragmatic way to avoid hand-transcribing large preset literals, and the data flow contains no attacker-controlled input.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/extract-defaults.mjs:43
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a build-time checking tool that runs the project's own code in a sandbox-like evaluator so it can verify the plugin exposes the right functions. It only runs the project's own bundled code, not anything from outside, and it is used during development testing rather than when the plugin is installed by users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged vm.runInThisContext call evaluates the project's own esbuild-bundled output so the audit harness can inspect the shape of globals the plugin publishes. The evaluated text is produced by esbuild from the project's own src/main.ts entry point; no external or user-controlled input reaches it. A minimal mock host object is installed beforehand so module top-level code can run without exercising behavior. This is a developer-time audit tool invoked via the npm audit script, not code shipped to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/audit.mjs:79
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged code that handles API keys. This extension needs API keys to do its job — it calls AI text and image services on behalf of the user. The flagged code is the part that saves and switches between the keys you type into the settings screen. There are no hardcoded secret keys in the file; it is just the machinery for managing keys you provide yourself.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched on source code that handles user-supplied API key configuration for LLM providers and NovelAI. The surrounding code defines functions that read and store apiKey properties from configuration objects (e.g., sR extracts format/endpoint/model/apiKey from a provider config; q0 writes provider config maps; fee manages per-provider key persistence when switching providers). These are property accesses on user-configured state objects, not hardcoded credential literals. The extension's stated purpose is to call LLM and image-generation APIs, which requires storing and using user-provided API keys. The settings UI uses password-type input fields for key entry, and keys are persisted in the extension's local configuration. No exfiltration to unauthorized destinations, concealed execution, or obfuscated data flow is present in the surrounding code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- Asset maid 0.9.2.js:325
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that loads the project's own built output to confirm it starts up correctly. It only runs code the project itself built, not anything from outside, and it is used during development rather than when the plugin is actually in use.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged call executes the project's own built bundle (dist/inlaynexus2.0.js) inside a Node smoke-test harness. The executed string is read from a local build artifact produced by the project's own build step, then truncated at the vendor UI boundary so only the backend half runs. No external or attacker-controlled input reaches the executed code. This is a developer test tool invoked via npm run smoke, not shipped runtime code, and its purpose is to verify the bundle boots and publishes expected globals.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/smoke.mjs:57
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary link key used to display a screenshot in a help guide. It is not a secret password or API key for any service.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an img src attribute in a static HTML guide. It is a signed, expiring access token for retrieving a screenshot, not a model-provider or service API credential. No code executes it and it grants no privileged access beyond fetching the referenced image.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:346
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:207
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link in a help guide. The scanner saw a URL parameter named key and flagged it, but it is just a temporary access token for loading that one image, not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched the key query parameter of a signed image URL on a community CDN. The surrounding HTML is a user guide document embedding screenshot images. The key value is a time-limited signed-URL token for image delivery, not an API credential or secret. It grants no access beyond fetching that specific image before expiry.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:207
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary link key for showing a screenshot in the guide, not a real secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is a key parameter on a CDN image URL within an img tag in a documentation HTML file. It is an expiring signed URL token for image retrieval, not a reusable API credential, and is not processed by any executable code in this file.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:264
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link parameter used to display a screenshot in a help page, not a password or API key. The scanner mistook the URL parameter for a secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed CDN image URL query parameter on a static HTML guide page. It is not an API key or credential; it is a time-limited image-access token embedded in an img src for documentation screenshots. No executable code, no secret usage, no exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:264
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just a parameter on a screenshot link in the guide, not a real secret. The scanner pattern matched a URL token by mistake.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is a signed image CDN URL parameter inside an img tag in a static HTML documentation file. It grants access only to that screenshot and is not a reusable API credential. No code execution or data flow is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:350
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link token in a help page, not an API key. There is no security issue.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is a query-string signing key on a CDN-hosted documentation image within a static HTML guide. It is scoped to a single image resource and is not an API key used by the plugin at runtime.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:302
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a developer testing tool that runs the project's own code in a sandbox to compare the new version against the old one. It only runs code that comes from the project itself, not from users or the internet, and it is not part of what users install.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate flags vm.runInThisContext at line 68. The code being executed is the esbuild-bundled output of the project's own src/main.ts entry point, built in-process with write:false. The file path and all inputs are derived from the project root, not from external or user-controlled data. This file is a dev-only parity harness (file) not included in the shipped package (package.json files lists only dist). Executing the bundled backend in a VM context is the stated purpose of the parity test: boot the new backend against a mock host and compare behavior with the old one.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/parity/run.mjs:68
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is another screenshot link in the help guide. The flagged key is just a temporary token for loading that image, not a real secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is the key query parameter of a signed image URL embedded in a guide HTML document. It is a CDN signed-URL token for displaying a screenshot, not a service credential. It cannot be used to authenticate to any API or access user data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:245
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:245
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just a parameter on an image link in the guide, not a secret. The scanner produced a false positive.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is a signed URL parameter for a documentation screenshot in a static HTML file. It is not a credential and is not referenced by any executable plugin code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:333
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link token in a help page, not an API key. No security concern.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is a CDN image signing parameter embedded in an img src within a static HTML guide. It authorizes only that specific screenshot and is not an API key or runtime credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:346
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary image-link key for a screenshot in the help page, not a secret credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is the key query parameter of a hosted image URL in an img src attribute within a static guide. It is a time-limited CDN access token for the screenshot, not an API key, and is not used by any runtime code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:302
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is the same testing tool loading the old version of the project's own code from a reference folder so it can compare old and new behavior. The code it runs comes from the repository itself, not from users or external sources, and this tool is not shipped to end users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate flags vm.runInThisContext at line 50. The code being executed is read from reference/native-backend.js, a read-only legacy 1.x source file located within the project repository. The path is constructed from the project root via path.join, not from user or network input. This is the loadOldBackend function in the dev-only parity harness, whose explicit purpose is to boot the legacy backend and compare its behavior against the new build. No untrusted data reaches the executed code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/parity/run.mjs:50
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged code that handles API keys, but this is just the plugin's normal settings management. The plugin needs API keys to call AI services like NovelAI and OpenAI—users type these keys into the settings screen. The flagged code simply copies and looks up those user-provided keys when saving or switching provider configurations. There is no hidden or hardcoded secret; the scanner matched on the word 'apiKey' and nearby text in the configuration code.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched at line 325, but the surrounding code shows this is configuration management logic, not a hardcoded secret. The function sR copies an analysis configuration object's properties—including apiKey—from a source object to a new snapshot object. Another redacted reference in function fee is a property-lookup expression (likely Object.hasOwn or similar) that checks whether a provider-specific API key exists in a providerKeyMap before falling back to a default. Both are part of the plugin's settings persistence layer, which stores user-entered API keys for LLM providers (OpenAI, Anthropic, Google, OpenRouter, custom) and NovelAI. The settings UI confirms these keys are entered by the user through password-type input fields. No hardcoded credential value is present; the scanner matched on code that references the apiKey property name and associated values during normal object copying and map lookups. The API keys flow only to the user-configured LLM endpoints and NovelAI API, matching the project's stated purpose of generating images via those services.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- Asset maid 0.9.2.js:325
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link in the guide. The scanner flagged the URL key parameter, but it only authorizes loading that one image temporarily.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is the key parameter of a signed image URL in a documentation HTML file. This is a time-limited CDN delivery token for a screenshot, not an API key or credential. No runtime code consumes it as a secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:134
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary link key for displaying a guide screenshot, not a real API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is a key parameter on an expiring CDN image URL inside an img tag in a documentation HTML file. It authorizes retrieval of a single screenshot and is not a service API credential or executable secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:350
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:194
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just a parameter on a screenshot link in the guide, not a real secret. The scanner matched a URL token by mistake.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is a signed query parameter on a CDN-hosted documentation image in a static HTML file. It is scoped to a single image and is not a reusable API credential or secret used by the plugin.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:315
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link in the help guide. The key in the URL is just a temporary image-loading token, not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is the key query parameter of a signed image URL used to display a screenshot in a guide document. It is a CDN signed-URL token with an expiry, not a credential. It provides no access beyond the referenced image.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:110
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:167
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:220
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is another screenshot link in the guide. The flagged key only authorizes loading that specific image temporarily.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is the key parameter of a signed image URL embedded in a guide HTML file. It is a time-limited CDN token for screenshot delivery, not an API credential. No code path treats it as a secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:194
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link in the help guide. The URL key is just a temporary token for that image, not a real secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is the key query parameter of a signed image URL in a documentation HTML file. It is a CDN signed-URL token with an expiry timestamp, used only to display a screenshot. It is not a service credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:220
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that loads the project's own backend code from a local file so it can run checks against it. The code being executed comes from the repository itself, not from anything a user or attacker could control. This is a normal way to test a backend module.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged line executes a local source file (src/native-backend.js) read from the repository's own filesystem via fs.readFileSync, then passes it to vm.runInThisContext. The executed code is a committed, local backend module—not user input, network data, or dynamically constructed strings. This is a standard smoke-test harness pattern for loading a built backend into the test process to exercise its API routes. No external or attacker-controlled data influences the code passed to the VM. The surrounding context confirms this is test infrastructure: it mocks fetch, polyfills browser APIs, and asserts health/settings behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- reference/smoke.mjs:186
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a developer benchmark tool that loads the project's own built code to test performance. It only runs when a developer explicitly runs the benchmark, and the code it executes is the project's own source, not anything from outside.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged vm.runInThisContext executes the project's own esbuild-bundled output (src/main.ts bundled as an IIFE) inside a Node benchmark harness. The script is a dev-only tool that seeds a mock host, boots the plugin, and measures gallery listing performance. The executed code is first-party build output, not user-controlled or externally sourced input, and runs only when a developer invokes the bench script.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/bench-gallery.mjs:114
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary image-link key for a screenshot in the guide, not a secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is the key query parameter of a hosted image URL in an img src attribute within a static guide. It is a signed, expiring token for fetching one screenshot and is not a reusable API credential.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:333
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:110
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a temporary link key for showing a screenshot in the help page, not a real secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is a key parameter on an expiring CDN image URL inside an img tag in a documentation HTML file. It grants access only to the referenced screenshot and is not a model-provider or service API key processed by runtime code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:315
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link in the guide. The scanner flagged the URL key, but it only authorizes loading that one image temporarily.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The match is the key parameter of a signed image URL embedded in a guide HTML document. It is a time-limited CDN delivery token for a screenshot, not an API key or credential. It grants no access beyond the referenced image.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:155
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a screenshot link in the help guide. The key in the URL is just a temporary image-loading token, not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is the key query parameter of a signed image URL in a guide HTML file. It is a CDN signed-URL token with an expiry, used to display a screenshot. It is not a credential and provides no API access.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:167