TavernKeeper Scan Report

happydesk213124/inlaynex2.0

Commit 0b3a8bd Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 39 low

What this review found

No material or immediate-danger item was identified.

Expected scanner matches (37)

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret. No code executes it and it grants no privileged access beyond viewing the screenshot.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:134

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:155

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a build-time helper script used by developers to extract configuration presets from an old reference file and save them as JSON. It uses a JavaScript feature that can run code dynamically, but the only code it runs comes from a file already committed in the repository, not from anything a user or attacker can control. It is not included in the plugin that users install.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The matched `Function` constructor is inside a developer-only build tool that reads a committed reference file from the repository, slices named object/array literals by brace/bracket balance, and evaluates those slices to serialize them as JSON config files. The evaluated text originates solely from a vendored reference source file under version control, not from user input, network data, or runtime configuration. The script runs only during development/build and is not part of the shipped plugin bundle. This is a pragmatic way to avoid hand-transcribing large preset literals, and the data flow contains no attacker-controlled input.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
tools/extract-defaults.mjs:43

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a build-time checking tool that runs the project's own code in a sandbox-like evaluator so it can verify the plugin exposes the right functions. It only runs the project's own bundled code, not anything from outside, and it is used during development testing rather than when the plugin is installed by users.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The flagged vm.runInThisContext call evaluates the project's own esbuild-bundled output so the audit harness can inspect the shape of globals the plugin publishes. The evaluated text is produced by esbuild from the project's own src/main.ts entry point; no external or user-controlled input reaches it. A minimal mock host object is installed beforehand so module top-level code can run without exercising behavior. This is a developer-time audit tool invoked via the npm audit script, not code shipped to end users.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
tools/audit.mjs:79

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner flagged code that handles API keys. This extension needs API keys to do its job — it calls AI text and image services on behalf of the user. The flagged code is the part that saves and switches between the keys you type into the settings screen. There are no hardcoded secret keys in the file; it is just the machinery for managing keys you provide yourself.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The gitleaks generic-api-key rule matched on source code that handles user-supplied API key configuration for LLM providers and NovelAI. The surrounding code defines functions that read and store apiKey properties from configuration objects (e.g., sR extracts format/endpoint/model/apiKey from a provider config; q0 writes provider config maps; fee manages per-provider key persistence when switching providers). These are property accesses on user-configured state objects, not hardcoded credential literals. The extension's stated purpose is to call LLM and image-generation APIs, which requires storing and using user-provided API keys. The settings UI uses password-type input fields for key entry, and keys are persisted in the extension's local configuration. No exfiltration to unauthorized destinations, concealed execution, or obfuscated data flow is present in the surrounding code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
Asset maid 0.9.2.js:325

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a test script that loads the project's own built output to confirm it starts up correctly. It only runs code the project itself built, not anything from outside, and it is used during development rather than when the plugin is actually in use.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The flagged call executes the project's own built bundle (dist/inlaynexus2.0.js) inside a Node smoke-test harness. The executed string is read from a local build artifact produced by the project's own build step, then truncated at the vendor UI boundary so only the backend half runs. No external or attacker-controlled input reaches the executed code. This is a developer test tool invoked via npm run smoke, not shipped runtime code, and its purpose is to verify the bundle boots and publishes expected globals.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
tools/smoke.mjs:57

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a temporary link key used to display a screenshot in a help guide. It is not a secret password or API key for any service.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a key query parameter on an image-hosting CDN URL inside an img src attribute in a static HTML guide. It is a signed, expiring access token for retrieving a screenshot, not a model-provider or service API credential. No code executes it and it grants no privileged access beyond fetching the referenced image.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:346

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:207

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link in a help guide. The scanner saw a URL parameter named key and flagged it, but it is just a temporary access token for loading that one image, not a password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The gitleaks generic-api-key rule matched the key query parameter of a signed image URL on a community CDN. The surrounding HTML is a user guide document embedding screenshot images. The key value is a time-limited signed-URL token for image delivery, not an API credential or secret. It grants no access beyond fetching that specific image before expiry.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:207

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a temporary link key for showing a screenshot in the guide, not a real secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is a key parameter on a CDN image URL within an img tag in a documentation HTML file. It is an expiring signed URL token for image retrieval, not a reusable API credential, and is not processed by any executable code in this file.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:264

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link parameter used to display a screenshot in a help page, not a password or API key. The scanner mistook the URL parameter for a secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed CDN image URL query parameter on a static HTML guide page. It is not an API key or credential; it is a time-limited image-access token embedded in an img src for documentation screenshots. No executable code, no secret usage, no exfiltration.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:264

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is just a parameter on a screenshot link in the guide, not a real secret. The scanner pattern matched a URL token by mistake.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is a signed image CDN URL parameter inside an img tag in a static HTML documentation file. It grants access only to that screenshot and is not a reusable API credential. No code execution or data flow is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:350

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link token in a help page, not an API key. There is no security issue.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged value is a query-string signing key on a CDN-hosted documentation image within a static HTML guide. It is scoped to a single image resource and is not an API key used by the plugin at runtime.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:302

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a developer testing tool that runs the project's own code in a sandbox to compare the new version against the old one. It only runs code that comes from the project itself, not from users or the internet, and it is not part of what users install.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: This candidate flags vm.runInThisContext at line 68. The code being executed is the esbuild-bundled output of the project's own src/main.ts entry point, built in-process with write:false. The file path and all inputs are derived from the project root, not from external or user-controlled data. This file is a dev-only parity harness (file) not included in the shipped package (package.json files lists only dist). Executing the bundled backend in a VM context is the stated purpose of the parity test: boot the new backend against a mock host and compare behavior with the old one.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
tools/parity/run.mjs:68

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is another screenshot link in the help guide. The flagged key is just a temporary token for loading that image, not a real secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is the key query parameter of a signed image URL embedded in a guide HTML document. It is a CDN signed-URL token for displaying a screenshot, not a service credential. It cannot be used to authenticate to any API or access user data.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:245

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:245

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is just a parameter on an image link in the guide, not a secret. The scanner produced a false positive.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is a signed URL parameter for a documentation screenshot in a static HTML file. It is not a credential and is not referenced by any executable plugin code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:333

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link token in a help page, not an API key. No security concern.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged value is a CDN image signing parameter embedded in an img src within a static HTML guide. It authorizes only that specific screenshot and is not an API key or runtime credential.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:346

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a temporary image-link key for a screenshot in the help page, not a secret credential.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is the key query parameter of a hosted image URL in an img src attribute within a static guide. It is a time-limited CDN access token for the screenshot, not an API key, and is not used by any runtime code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:302

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is the same testing tool loading the old version of the project's own code from a reference folder so it can compare old and new behavior. The code it runs comes from the repository itself, not from users or external sources, and this tool is not shipped to end users.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: This candidate flags vm.runInThisContext at line 50. The code being executed is read from reference/native-backend.js, a read-only legacy 1.x source file located within the project repository. The path is constructed from the project root via path.join, not from user or network input. This is the loadOldBackend function in the dev-only parity harness, whose explicit purpose is to boot the legacy backend and compare its behavior against the new build. No untrusted data reaches the executed code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
tools/parity/run.mjs:50

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner flagged code that handles API keys, but this is just the plugin's normal settings management. The plugin needs API keys to call AI services like NovelAI and OpenAI—users type these keys into the settings screen. The flagged code simply copies and looks up those user-provided keys when saving or switching provider configurations. There is no hidden or hardcoded secret; the scanner matched on the word 'apiKey' and nearby text in the configuration code.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The gitleaks generic-api-key rule matched at line 325, but the surrounding code shows this is configuration management logic, not a hardcoded secret. The function sR copies an analysis configuration object's properties—including apiKey—from a source object to a new snapshot object. Another redacted reference in function fee is a property-lookup expression (likely Object.hasOwn or similar) that checks whether a provider-specific API key exists in a providerKeyMap before falling back to a default. Both are part of the plugin's settings persistence layer, which stores user-entered API keys for LLM providers (OpenAI, Anthropic, Google, OpenRouter, custom) and NovelAI. The settings UI confirms these keys are entered by the user through password-type input fields. No hardcoded credential value is present; the scanner matched on code that references the apiKey property name and associated values during normal object copying and map lookups. The API keys flow only to the user-configured LLM endpoints and NovelAI API, matching the project's stated purpose of generating images via those services.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
Asset maid 0.9.2.js:325

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link in the guide. The scanner flagged the URL key parameter, but it only authorizes loading that one image temporarily.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is the key parameter of a signed image URL in a documentation HTML file. This is a time-limited CDN delivery token for a screenshot, not an API key or credential. No runtime code consumes it as a secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:134

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a temporary link key for displaying a guide screenshot, not a real API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is a key parameter on an expiring CDN image URL inside an img tag in a documentation HTML file. It authorizes retrieval of a single screenshot and is not a service API credential or executable secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:350

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:194

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is just a parameter on a screenshot link in the guide, not a real secret. The scanner matched a URL token by mistake.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is a signed query parameter on a CDN-hosted documentation image in a static HTML file. It is scoped to a single image and is not a reusable API credential or secret used by the plugin.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:315

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link in the help guide. The key in the URL is just a temporary image-loading token, not a password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged value is the key query parameter of a signed image URL used to display a screenshot in a guide document. It is a CDN signed-URL token with an expiry, not a credential. It provides no access beyond the referenced image.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:110

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:167

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:220

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is another screenshot link in the guide. The flagged key only authorizes loading that specific image temporarily.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is the key parameter of a signed image URL embedded in a guide HTML file. It is a time-limited CDN token for screenshot delivery, not an API credential. No code path treats it as a secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:194

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link in the help guide. The URL key is just a temporary token for that image, not a real secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged value is the key query parameter of a signed image URL in a documentation HTML file. It is a CDN signed-URL token with an expiry timestamp, used only to display a screenshot. It is not a service credential.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:220

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a test script that loads the project's own backend code from a local file so it can run checks against it. The code being executed comes from the repository itself, not from anything a user or attacker could control. This is a normal way to test a backend module.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The flagged line executes a local source file (src/native-backend.js) read from the repository's own filesystem via fs.readFileSync, then passes it to vm.runInThisContext. The executed code is a committed, local backend module—not user input, network data, or dynamically constructed strings. This is a standard smoke-test harness pattern for loading a built backend into the test process to exercise its API routes. No external or attacker-controlled data influences the code passed to the VM. The surrounding context confirms this is test infrastructure: it mocks fetch, polyfills browser APIs, and asserts health/settings behavior.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
reference/smoke.mjs:186

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a developer benchmark tool that loads the project's own built code to test performance. It only runs when a developer explicitly runs the benchmark, and the code it executes is the project's own source, not anything from outside.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The flagged vm.runInThisContext executes the project's own esbuild-bundled output (src/main.ts bundled as an IIFE) inside a Node benchmark harness. The script is a dev-only tool that seeds a mock host, boots the plugin, and measures gallery listing performance. The executed code is first-party build output, not user-controlled or externally sourced input, and runs only when a developer invokes the bench script.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
tools/bench-gallery.mjs:114

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a temporary image-link key for a screenshot in the guide, not a secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is the key query parameter of a hosted image URL in an img src attribute within a static guide. It is a signed, expiring token for fetching one screenshot and is not a reusable API credential.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:333

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a link token used to display a screenshot in the help guide. It only lets people view that image and is not a secret password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The matched value is a signed query parameter on a public image-hosting URL embedded in an HTML guide screenshot. It is a time-limited CDN access token for displaying an image, not a reusable API credential or secret.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:110

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a temporary link key for showing a screenshot in the help page, not a real secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is a key parameter on an expiring CDN image URL inside an img tag in a documentation HTML file. It grants access only to the referenced screenshot and is not a model-provider or service API key processed by runtime code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:315

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link in the guide. The scanner flagged the URL key, but it only authorizes loading that one image temporarily.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The match is the key parameter of a signed image URL embedded in a guide HTML document. It is a time-limited CDN delivery token for a screenshot, not an API key or credential. It grants no access beyond the referenced image.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:155

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is a screenshot link in the help guide. The key in the URL is just a temporary image-loading token, not a password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged value is the key query parameter of a signed image URL in a guide HTML file. It is a CDN signed-URL token with an expiry, used to display a screenshot. It is not a credential and provides no API access.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
아카라이브_인레이넥서스_가이드.html:167

Related contextual observations

All gitleaks matches are signed CDN image links in a help guide

low risk · high confidence

All flagged items are just the access tokens attached to screenshot links in the help page. They let the help page show images and are not real secrets.

Technical assessment

Every candidate is a key query parameter on an image-hosting URL used to display screenshots inside an HTML user guide. These are time-limited signed URLs for public image delivery, not API keys or service credentials. The file is static documentation with no executable code that reads or transmits secrets.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Benchmark harness bundles and executes first-party source in Node vm context

low risk · high confidence

The benchmark builds the plugin from its own source files and runs it in a simulated environment to measure speed. Nothing from outside the project is executed.

Technical assessment

The tool imports esbuild, bundles src/main.ts with project-defined constants, and runs the resulting IIFE via vm.runInThisContext to boot the plugin against a mock host (installHost). This is a standard pattern for loading a browser-targeted IIFE in a Node test harness. No external or user-controlled code reaches the vm execution path.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity