No material or immediate-danger item was identified.
Contextual expected matches (60)
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner matched the key part of an image link in the help page. That key is just a short-lived signature on the image address so the picture can load; it is not a password for the app or any service.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 167 is an img tag whose src points to the Arcalive image CDN and carries a query string with an expires timestamp and a key parameter. That key is a short-lived signed-URL token for the hosted screenshot, not an application or API credential. The file is a user guide HTML document; the value is a URL parameter rendered as documentation and no code consumes it as a secret. Gitleaks generic-api-key matched the key= parameter, which is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:167
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The flagged entries are simply the usual local addresses where programs like LM Studio and Ollama run models on your own computer. This file just lists preset addresses; it doesn't secretly send anything anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literal is a static preset for a local model server listening on a loopback address (the standard default for LM Studio), and the neighboring preset covers the local Ollama default; both are labeled as local providers. This module is a pure configuration and URL-construction helper that performs no network I/O of its own and sends nothing anywhere. The scanner signal fires only because these presets use plain HTTP against a loopback host, which is the normal way local inference servers are reached. No credential handling, exfiltration, or unexpected destination is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- reference/llm-providers.js:7
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
This is a minified plugin file, like a compressed version of the original code. Minification is a normal step to make plugins load faster.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The file is a minified Vite bundle. Base64-encoded chunks and compacted code are normal bundler output and do not represent intentional obfuscation. No hidden or concealed logic is present beyond standard module wrapping.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- generated
- Source
- dist/inlaynexus2.0.js:1
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · medium confidence
This is a normal way to check if a string contains a number. It is not dangerous.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regular expression is a numeric pattern used for parsing values. Such patterns are common in UI styling libraries and do not exhibit catastrophic backtracking characteristics. The scanner signal reflects a generic pattern match rather than an exploitable regex denial-of-service.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- Asset maid 0.9.2.js:6
Gitleaks reported generic-api-key
Expected behavior · high confidence
This flag is just the signing key inside an image link used to display a screenshot in the guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is an image element in a user guide HTML file. The matched value is a query parameter on a community image CDN resource URL: an expiry timestamp paired with a signature key that the CDN uses to authorize a specific image request. It is not an application credential, API key, or secret with access to user data or provider accounts. This is a standard signed-URL mechanism for hotlinked images and matches the document's purpose as a tutorial with embedded screenshots.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:264
Gitleaks reported generic-api-key
Expected behavior · medium confidence
A security scanner flagged a spot in the minified asset-management code as a possible password or key. Reviewing the surrounding code, that spot is just doing normal work: listing image assets, reading their metadata, and skipping certain checks. The actual flagged value was not retained, so we cannot confirm it is a secret, and nothing in the code shows a secret being sent anywhere. It looks like a false alarm from the pattern scanner.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The gitleaks generic-api-key match occurs inside a large minified production line of the asset-management bundle. The surrounding code performs benign, purpose-consistent operations: flattening selected assets, inspecting image metadata via an injected metadata service, skipping inspection when image-only analysis is selected, collecting skipped asset names, and assembling analysis result records. The matched token value was removed, so the evidence cannot show an actual credential, where it is sent, or that it is used. In minified UI bundles, generic secret patterns frequently match hex strings, short identifiers, or similar incidental text. No network destination, exfiltration path, or credential usage is demonstrated anywhere in the supplied context, and the project documentation states the plugin only opens network connections to user-configured image and LLM APIs. Without the matched literal or a data flow, this remains a pattern correlation with no demonstrated exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- Asset maid 0.9.2.js:325
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is another image link in the guide. The key part is a temporary signature on the image address, not a real password.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 245 is an img tag loading a screenshot from the Arcalive image CDN with an expires parameter and a key query value. The matched string is the signed URL token for that image resource, present only as documentation content in a guide HTML file. There is no credential handling, no application code path, and no network behavior beyond the browser loading the referenced image. The generic-api-key match is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:245
Gitleaks reported generic-api-key
Expected behavior · high confidence
This flag is just the signing key inside an image link used to display a screenshot in the guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is an image element in a user guide HTML file. The matched value is a query parameter on a community image CDN resource URL: an expiry timestamp paired with a signature key that the CDN uses to authorize a specific image request. It is not an application credential, API key, or secret with access to user data or provider accounts. This is a standard signed-URL mechanism for hotlinked images and matches the document's purpose as a tutorial with embedded screenshots.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:350
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The extension talks to image-making services over the internet, which is what it is supposed to do. There is no sign that it runs hidden computer commands from those services.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The extension makes network requests to configured image generation and LLM APIs as part of its core function. The dynamic code execution sink was not confirmed in the examined evidence; the correlation is based on the presence of both primitives without demonstrated attacker reachability. The data flow appears limited to decoding base64 image data and constructing OAuth tokens, not arbitrary code execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- Asset maid 0.9.2.js:6-11
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Gitleaks flagged a query parameter value in an image URL as a generic API key, but the value is a CDN signature key for arca.live image hosting. The file is a static HTML guide with no executable code. No credential is exposed.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:207
Gitleaks reported generic-api-key
Expected behavior · high confidence
This flag is just the signing key inside an image link used to display a screenshot in the guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is an image element in a user guide HTML file. The matched value is a query parameter on a community image CDN resource URL: an expiry timestamp paired with a signature key that the CDN uses to authorize a specific image request. It is not an application credential, API key, or secret with access to user data or provider accounts. This is a standard signed-URL mechanism for hotlinked images and matches the document's purpose as a tutorial with embedded screenshots.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:333
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · high confidence
The flagged text is just part of a built-in icon library used for buttons and UI. Those short labels are normal identifiers an icon tool generates, not hidden code or secrets. Nothing here transmits data or does anything suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.
Contextual assessment: The flagged literal is part of a bundle of Lucide-style SVG icon definitions. The captured window shows repeated calls to an icon factory (ht) with path data (d properties) and short generated keys (key properties) such as 1357e3, 1xhq8a, and 1fdv2h. These short opaque strings are collision-resistant keys emitted by the icon build pipeline, not encoded payloads, secrets, or exfiltration targets. The scanner signal of an encoded literal in minified third-party UI code is consistent with normal bundler output and does not indicate concealed behavior. The window contains only static data and no network, storage, or dynamic-execution flow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- production
- Source
- Asset maid 0.9.2.js:17394
Gitleaks reported generic-api-key
Expected behavior · high confidence
The key on this line belongs to the image link, letting the picture load from the hosting site. It is not an app or service password.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 134 is an img tag whose src contains an Arcalive CDN URL with an expires value and a key query parameter. The key is a signed CDN token for the displayed screenshot, found only in static HTML documentation. The guide contains no script or data flow that treats this value as a credential. The generic-api-key scanner match is a false positive with no demonstrated exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:134
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The code looks like it might download and run code from the internet, but it's actually a test script that loads a local file and then makes API calls to check if the program works. No actual downloading of code happens.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The candidate flags a correlation between network retrieval (line 195 N.fetch) and vm.runInThisContext (line 186). However, the vm execution is from a local file read (fs.readFileSync) and is unrelated to the network call. The N.fetch is used to query the native backend API for job status, not to retrieve executable code. This is a smoke test harness: it first loads the native backend module from disk, then exercises its API endpoints. There is no data flow from network to code execution.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- reference/smoke.mjs:186-195
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged parts of image links as secret keys, but they are just normal parts of the web address. No real secrets are exposed.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Candidates are false-positive matches on CDN image URL signature keys in a static HTML guide file. No executable code, no credential exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:264
Gitleaks reported generic-api-key
Expected behavior · high confidence
This flag is just the signing key inside an image link used to display a screenshot in the guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is an image element in a user guide HTML file. The matched value is a query parameter on a community image CDN resource URL: an expiry timestamp paired with a signature key that the CDN uses to authorize a specific image request. It is not an application credential, API key, or secret with access to user data or provider accounts. This is a standard signed-URL mechanism for hotlinked images and matches the document's purpose as a tutorial with embedded screenshots.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:315
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged parts of image links as secret keys, but they are just normal parts of the web address. No real secrets are exposed.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as above: static guide, false-positive from CDN URL key parameter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:350
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged parts of image links as secret keys, but they are just normal parts of the web address. No real secrets are exposed.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as above: static guide, false-positive from CDN URL key parameter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:302
JavaScript analysis reported javascript.download-to-execution
Expected behavior · low confidence
This is a large file that talks to the AI-image and text services the plugin is supposed to use. The scanner noticed it contains both network calls and code that runs in memory, but the evidence doesn't show those being chained to do anything harmful.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: This rule fires when a network retrieval primitive and a dynamic code-execution sink both exist somewhere in a very large bundled file. The network destinations in the evidence are the image-generation, OAuth token, and LLM provider endpoints the project must call to fulfill its stated purpose, and the evidence does not show any path where fetched content reaches an execution sink; responses are handled as JSON data for prompts and settings. The file also sits in a read-only reference directory used by audit and parity tooling rather than the shipped bundle, and no attacker-controlled trigger to any execution sink is demonstrated. A primitive correlation without a demonstrated reachable sink is not demonstrated exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- reference/native-backend.js:7-7061
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The code uses a few ordinary word-matching patterns to recognize words like 'girl' or 'man' in AI-generated image tags. There is nothing here that lets an outsider cause harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged line region contains fixed word-matching patterns used to classify gender and person tags in LLM-generated prompt text. These are static alternations over ordinary words with no nested quantifiers and no attacker-supplied pattern content, so they do not exhibit the catastrophic backtracking the scanner heuristic looks for. Inputs to these matchers are internally generated tag text, and no user or remote input supplies the pattern. Pattern-quality findings without a demonstrated abuse path are not material.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- reference/native-backend.js:434
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as other candidates: gitleaks false-positive on CDN image URL signature key. Static guide file, no runtime exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:245
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The scan pattern sees that this plugin can both fetch data over the internet and run code dynamically. The code shown to me is mostly normal plugin boilerplate, and the project openly says it talks to the image and LLM services you configure. There is no evidence that fetched content is actually executed or sent anywhere unexpected.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags a co-occurrence of network retrieval and a dynamic code-execution primitive across a large minified bundle (lines 6-4265). The supplied source windows show bundler/IIFE scaffolding, scheduling helpers, regex utilities, image data-URI decoding, and UI logic, but no data flow is demonstrated from a network response into an eval, Function, script-injection, or other execution sink. The project README discloses that the plugin calls configured LLM and image-generation APIs, so network access is consistent with the stated purpose. No attacker-controlled trigger, destination, or executed payload is shown, so exposure is not demonstrated by this evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- Asset maid 0.9.2.js:6-4265
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged parts of image links as secret keys, but they are just normal parts of the web address. No real secrets are exposed.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as above: static guide, false-positive from CDN URL key parameter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:333
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged parts of image links as secret keys, but they are just normal parts of the web address. No real secrets are exposed.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as above: static guide, false-positive from CDN URL key parameter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:346
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The plugin uses standard web features; it doesn't download and run unknown scripts.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: Same bundler artifact: the minified bundle contains both network fetch and dynamic execution patterns typical of modern bundlers. No actual download-to-execution chain was identified; the plugin does not fetch remote code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- generated
- Source
- dist/inlaynexus2.0.js:15-599
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a false alarm. The code checks that a test image is a proper base64 data URI, which is exactly what it should do in a smoke test. No shady link or real network call is involved.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The X-Ray signal was raised by a static check on line 490 that verifies image URLs returned by the mocked backend are base64-encoded data URIs (startsWith "data:image/png;base64,"). This is a normal assertion in a smoke-test harness (file) that validates correct data-URL formatting; it does not initiate any network request or process untrusted input. The data URI pattern is used legitimately here as part of a test expectation, not as a shady link.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- reference/smoke.mjs:490
JavaScript analysis reported javascript.xray.encoded-literal
Expected behavior · medium confidence
This is just how the code looks after being compressed to run faster. Nothing secret or dangerous is hidden there.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.encoded-literal. The match applies to this repository.
Contextual assessment: The encoded literals are standard minified JavaScript patterns used for regular expression definitions and SVG icon data. No hidden or obfuscated payloads were identified; the encoding is a natural result of the Vite build process and library bundling.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.encoded-literal
- File role
- production
- Source
- Asset maid 0.9.2.js:89
Gitleaks reported generic-api-key
Expected behavior · high confidence
This flag is just the signing key inside an image link used to display a screenshot in the guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is an image element in a user guide HTML file. The matched value is a query parameter on a community image CDN resource URL: an expiry timestamp paired with a signature key that the CDN uses to authorize a specific image request. It is not an application credential, API key, or secret with access to user data or provider accounts. This is a standard signed-URL mechanism for hotlinked images and matches the document's purpose as a tutorial with embedded screenshots.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:346
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
This tool builds the plugin and tests it with synthetic data. The security scanner saw a code-execution function and a network request in the same file and warned, but the network request is just a local test; the built code comes from the developer's own files, not the internet. It's safe.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags a correlation between network retrieval and vm.runInThisContext, but the evidence shows no network download to execution. The vm.runInThisContext call at line 114 executes a locally built bundle from esbuild (source files in repo), not fetched over network. The only fetch later in the file is to a local mock host. This is a test-only tool (benchmark) that never ships to users. No actual code execution from external input.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- tools/bench-gallery.mjs:114-134
Gitleaks reported generic-api-key
Expected behavior · high confidence
This match is the signature portion of an image link in the guide. It expires and only works for that picture; it is not a secret key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 220 is an img tag for a screenshot hosted on the Arcalive CDN, with an expires timestamp and key query parameter. The key is the URL signature for that image, present as static guide content. No application code reads or transmits this value as a secret. The generic-api-key match is a false positive and no attacker-controlled path or credential exposure is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:220
Gitleaks reported generic-api-key
Expected behavior · medium confidence
A scanner thought it saw a password-like string in one line of the app's bundled code, but that line is just ordinary programming logic that reads image metadata. Nothing in the shown code stores or sends a real password.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Gitleaks flagged a generic API key pattern at line 325 of the minified production bundle, but the matched value was removed and is not present in the supplied evidence. The cited line defines an asset-metadata inspection routine that reads image metadata and aggregates summaries; it contains no credential assignment, secret header, external destination, or storage flow. In minified bundles, generic-api-key rules routinely false-positive on hashes, hex strings, and base64-like tokens. No credential exposure, exfiltration, or attacker-controlled data flow is demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- Asset maid 0.9.2.js:325
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged text is the temporary signature on an image link within the help page, not a password for any service.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 207 is an img tag loading a screenshot from the Arcalive image CDN with an expires parameter and a key query value. The matched value is a signed-URL token for the image, found only in the static HTML guide. There is no script that consumes the value as an API key, no destination for exfiltration, and no demonstrated exposure beyond the item being a URL in documentation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:207
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as other candidates: gitleaks false-positive on CDN image URL signature key. Static guide file, no runtime exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:134
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The plugin saves and sends data as JSON, which is normal for storing settings and talking to AI services. Your API keys are only sent to the services you configure.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: JSON.stringify is used extensively for serializing objects to store metadata, send API payloads, and log debug info. Credentials are passed as Bearer tokens in Authorization headers to configured API endpoints, which is required for the plugin's image generation and LLM functions. No evidence of credential exfiltration to third-party or unexpected destinations.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- generated
- Source
- dist/inlaynexus2.0.js:8156
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The links the scanner found are either normal web addresses for AI services or standard technical names used by the web page framework. Nothing suspicious.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The 'shady-link' signal flagged 25 occurrences, but the visible evidence shows legitimate URLs: the OAuth token exchange for Vertex AI (line 5218) uses a proper JWT grant flow, and many other flagged locations are standard SVG namespace URIs, React xlink attributes, and XML namespace declarations. These are all expected in a React-based UI plugin that integrates with cloud AI services. No signs of phishing, credential theft, or unauthorized network destinations.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- Asset maid 0.9.2.js:5218
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged parts of image links as secret keys, but they are just normal parts of the web address. No real secrets are exposed.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as above: static guide, false-positive from CDN URL key parameter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:315
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as other candidates: gitleaks false-positive on CDN image URL signature key. Static guide file, no runtime exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:110
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The web addresses this file lists are the official services the plugin is meant to contact — image generation, your chosen AI text provider, and a local ComfyUI server on your own machine. That is the plugin doing its advertised job, not sneaking data somewhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged literals are the configured service endpoints the plugin is designed to call for LLM tagging and image generation, plus a loopback default for a local ComfyUI-compatible server on its standard port. The README explicitly states the plugin opens connections only to the image and LLM APIs the user configures, and credential headers in the evidence are attached only to those provider requests as normal API authentication. All destinations match the stated purpose; there are no hidden or unexpected recipients.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- reference/native-backend.js:333
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · low confidence
A scanner thought this code was hidden or scrambled, but looking at the actual code shows it's normal and easy to read. Nothing suspicious here.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: JS-X-Ray flagged this file as obfuscated, but the supplied source is well-structured, readable JavaScript with no actual obfuscation. The signal likely matches a heuristic (e.g., RegExp or string operations) that does not indicate malicious intent. The scanner confidence is low.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- risutts.plugin.js:1
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as other candidates: gitleaks false-positive on CDN image URL signature key. Static guide file, no runtime exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:194
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The plugin connects only to the AI image and text services you choose to use, like NovelAI or OpenAI. It doesn't connect to unknown servers.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Network requests target well-known API endpoints (OpenAI, NovelAI, Google Vertex, Anthropic, ComfyUI localhost) and are made only when the user configures those services. The plugin's stated purpose requires these connections. No unexpected or hidden network destinations were found.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- dist/inlaynexus2.0.js:700
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as other candidates: gitleaks false-positive on CDN image URL signature key. Static guide file, no runtime exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:220
Gitleaks reported generic-api-key
Expected behavior · high confidence
This flag is just the signing key inside an image link used to display a screenshot in the guide. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: The flagged line is an image element in a user guide HTML file. The matched value is a query parameter on a community image CDN resource URL: an expiry timestamp paired with a signature key that the CDN uses to authorize a specific image request. It is not an application credential, API key, or secret with access to user data or provider accounts. This is a standard signed-URL mechanism for hotlinked images and matches the document's purpose as a tutorial with embedded screenshots.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:302
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · medium confidence
The extension connects to image generation services as advertised. These links are necessary for it to work.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged network access includes OAuth token exchange and image API requests, which are integral to the plugin's stated purpose of generating images via NovelAI. The target URLs are derived from configuration rather than hardcoded suspicious domains. The shady-link signal is a heuristic that does not account for legitimate API authentication flows.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- Asset maid 0.9.2.js:16
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code runs only during automated tests. It loads the backend code into Node to test it, which is exactly how the test is designed to work. No risk to users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The vm.runInThisContext call on line 186 executes the built backend source (native-backend.js) inside the smoke-test harness. This is entirely contained in the development/test pipeline (file) and is never shipped or run in a user-facing extension. The input is a hardcoded file read from the project's own source tree; no attacker-controlled data reaches this call. Dynamic execution in a CI test is appropriate for loading and testing the backend module.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- reference/smoke.mjs:186
Gitleaks reported generic-api-key
Expected behavior · high confidence
The match is the key query on an image address in the guide. It is a short-lived token for loading that picture, not a real secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 194 is an img tag pointing to a screenshot on the Arcalive CDN with an expires value and key query parameter. The key is the image's signed URL token rendered as guide documentation. No code path assigns, stores, or transmits this value as a credential, so the generic-api-key match is a false positive with no demonstrated risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:194
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · low confidence
A scanner warned about links in the code, but they all point to your own computer (localhost), which is normal for this type of plugin that talks to a local server.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The scanner flagged URLs in the code as 'shady links,' but these are localhost endpoints (127.0.0.1:8090, 127.0.0.1:8088) used to connect to a local TTS server. This is expected behavior for a TTS plugin and does not exfiltrate data to external hosts.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- risutts.plugin.js:31
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The tool loads the plugin from a local file on your computer and runs it to make sure it works. This is a normal part of testing, not a security issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: This test harness intentionally reads the pre-built plugin artifact from a local file and executes it via vm.runInThisContext to verify functionality. No network retrieval is involved; the file path is fixed and controlled. The code execution sink is used for its intended purpose as a smoke test, not for arbitrary or attacker-supplied code. There is no demonstrated exposure to a real threat.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- tools/smoke.mjs:67-109
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The UI code is compact (minified) to load faster, which a scanner mistook for hidden code. But it's normal for software; nothing is hidden.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The obfuscated-code signal fires because the vendored UI file is a minified Vite build (bundled and minified). The code is readable and does not exhibit concealment of malicious behavior. Minification is standard for production JavaScript and not obfuscation in the security sense. Low scanner confidence. No risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- vendored
- Source
- vendor/inlay-nexus-ui.js:1
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The plugin only connects to the AI services you set up.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: Network requests target well-known API endpoints (OpenAI, NovelAI, Google Vertex, Anthropic, ComfyUI localhost) as configured by the user. No unexpected destinations.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- generated
- Source
- dist/inlaynexus2.0.js:19
JavaScript analysis reported javascript.xray.serialize-environment
Expected behavior · high confidence
The plugin uses JSON to save and send data normally, and sends API keys only to the services you choose.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: JSON.stringify is used for serializing objects to store, send API payloads, and log. Credentials are sent only to configured services via Authorization headers. No exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.serialize-environment
- File role
- generated
- Source
- dist/inlaynexus2.0.js:38
JavaScript analysis reported javascript.download-to-execution
Expected behavior · low confidence
A scanner thought the plugin might download and run code from the internet, but actually it only makes normal API calls to your local computer.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flagged the combination of network retrieval (fetch) and a potential code execution sink, but the supplied source shows only standard fetch calls for API communication with a local TTS server. No dynamic code execution (eval, Function, etc.) is present. The signal is a false correlation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- risutts.plugin.js:1047-17170
JavaScript analysis reported javascript.download-to-execution
Expected behavior · low confidence
The plugin uses standard web technologies—it fetches data and builds parts of its interface dynamically. The scanner saw both capabilities in the same file and flagged it, but there's no evidence that an attacker could trick the plugin into running bad code.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags a correlation between network retrieval (fetch/XMLHttpRequest) and code execution primitives (eval/Function) in the UI bundle embedded in the build output. The UI bundle is a frozen upstream artifact; the project's backend communicates over a fixed contract and does not evaluate untrusted responses as code. No demonstrated path where an attacker controls network content that reaches a dynamic code sink. The tooling file file orchestrates the build but does not execute the UI bundle at runtime.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- tooling
- Source
- vite.config.ts:7695-11383
JavaScript analysis reported javascript.download-to-execution
Expected behavior · medium confidence
The plugin uses standard web features to load its own code and talk to AI services. It does not download and run unknown programs.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The bundle contains both network fetch primitives (fetch/XHR) and dynamic code execution patterns that are typical of Vite/Rollup module loaders and runtime code composition. The plugin does not download and execute external scripts or fetch arbitrary code from the network. The correlation is a bundler artifact, not a malicious download-to-execution chain.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- generated
- Source
- dist/inlaynexus2.0.js:17-22323
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as other candidates: gitleaks false-positive on CDN image URL signature key. Static guide file, no runtime exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:155
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is an image link in the guide where the key is a temporary signature for the picture. No password is involved.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 110 is an img tag with an Arcalive CDN src containing an expires timestamp and key query parameter. The key is a signed-URL token for the screenshot and exists only as static content in a user guide. It is not a plugin, LLM, NovelAI, or ComfyUI credential, and no executable code uses it as a secret. The generic-api-key match is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:110
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged key is part of the image link that lets the screenshot load from the hosting site. It is not an app or account password.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Line 155 is an img tag loading a screenshot from the Arcalive CDN with an expires parameter and key query value. The matched value is the image's signed URL token, present only as documentation content in the HTML guide. There is no credential handling, secret storage, or external data flow involving this value. The generic-api-key scanner match is a false positive and exposure is not demonstrated.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:155
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The tool checks that an image preview uses a proper data URL, which is exactly what it should do. There is no shady or remote link involved.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged line checks that a reference image preview URL starts with the expected data URL scheme. This is a legitimate assertion confirming the plugin generates correct image data. No external or suspicious URL is used; the data URL is created locally from a known test image. The security scanner signal is a false positive for this context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- production
- Source
- tools/smoke.mjs:147
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook part of an image link for a secret key, but it is just a normal part of the web address used to display pictures. No real password or token is at risk.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key. The match applies to this repository.
Contextual assessment: Same as other candidates: gitleaks false-positive on CDN image URL signature key. Static guide file, no runtime exposure.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:167
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The plugin talks to a local program on your computer and to image services you configure—that's what it's supposed to do. The scanner warning is about those connections, not about hidden malicious behavior.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The vendored UI bundle contains a hardcoded localhost URL (127.0.0.1:28120) as the default backend address, and user-configurable fields for external image generation APIs (NovelAI, ComfyUI). The 'shady-link' scanner signal matches this expected network communication pattern for a plugin that connects to a local backend and remote image services. No evidence of exfiltration or non-consensual data transmission.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.shady-link
- File role
- vendored
- Source
- vendor/inlay-nexus-ui.js:150