No material or immediate-danger item was identified.
Expected scanner matches (22)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a build helper that reads a file already in the repository, extracts configuration blocks from it, and writes them out as JSON. It only runs during development, not when the plugin is used, and it only processes files that are already part of the project. There is no way for outside input to reach this code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The Function constructor evaluates text sliced from a local committed reference file (reference/native-backend.js) to extract object and array literals and serialise them as JSON config files. This is a development-time build tool; the package ships only the dist directory. No user input, network data, or runtime plugin context reaches the evaluated text. The source is a first-party committed file read synchronously from the repository root. The dynamic execution is proportionate to the stated purpose of avoiding hand-transcription of large config presets.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/extract-defaults.mjs:43
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a developer testing tool, not part of the plugin users install. It runs the project's own code in a test environment to check that the plugin exposes the right functions. The code being executed comes from the project itself, not from any external or untrusted source, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged vm.runInThisContext call is inside a development-only audit harness (file) invoked via npm run audit. It bundles the project's own src/main.ts with esbuild into an IIFE, provides a minimal mock risuai host object, then executes the bundle solely to read the published __INLAY_NATIVE__ global and verify its shape against a required interface list. The executed code is the project's own first-party bundled source, not attacker-controlled or network-sourced input. The tool is not shipped to end users—package.json files field includes only dist. No credentials, network calls, persistence, or obfuscation are involved. This is a standard pattern for a build-time shape/introspection audit.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/audit.mjs:79
Gitleaks reported generic-api-key
Expected behavior · medium confidence
A secret-scanning tool flagged a piece of code that mentions API keys. Looking at the actual code, it is normal settings-handling logic that stores and copies the API key the user types into the plugin's configuration screen. There is no hardcoded secret — the code is just moving the user's own credential between configuration objects so the plugin can call the AI services the user chose. This is exactly what a plugin like this needs to do.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched code in a bundled production JavaScript file. The surrounding code shows configuration management functions that copy and reassign an apiKey property between configuration objects — for example, a snapshot function that returns a copy of analysis provider settings and a provider-switching function that reads from a providerKeyMap. The redacted tokens appear in positions where the source code references e.apiKey or e.providerKeyMap[t], which are property accesses on user-supplied configuration objects, not hardcoded secret literals. The project's stated purpose requires users to configure their own LLM and image-generation API credentials, so handling apiKey fields in settings and state-management code is proportional and expected. No exfiltration destination, concealed network call, or hardcoded credential string is visible in the supplied context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- Asset maid 0.9.2.js:325
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that runs the project's own built plugin file to confirm it starts up correctly. It only executes code the project itself compiled, not anything from outside or from users, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged line executes the project's own built bundle (dist/inlaynexus2.0.js) inside a Node smoke-test harness. The input to vm.runInThisContext is backendHalf(), which reads the locally built output file and slices off the vendor UI section. No external or attacker-controlled input reaches the executed string. This is a standard test-harness pattern for verifying that the built plugin boots and publishes expected globals. The file role is production tooling, but the executed code is the project's own build artifact, not dynamically fetched or user-supplied content.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/smoke.mjs:57
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link to a screenshot image on a public image-hosting site. The key in the link just lets you view that picture before it expires. It is not a secret password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key parameter on a screenshot image URL hosted on a public image board. It is embedded in a static HTML guide document as part of an img src attribute, paired with an expires timestamp. It is not an API credential, has no runtime data flow, and grants only time-limited read access to a public screenshot.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:207
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link to a screenshot in a help guide. The scanner mistook the link's access code for a secret API key, but it is just part of a public image URL.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed CDN image URL query parameter on an arca.live image link inside a static HTML guide. It is not an API key or credential; it is a time-limited access token for a public screenshot embedded in documentation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:264
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link to a screenshot in a help guide. The scanner mistook the link's access code for a secret API key, but it is just part of a public image URL.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed CDN image URL query parameter on an arca.live image link inside a static HTML guide. It is not an API key or credential; it is a time-limited access token for a public screenshot embedded in documentation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:350
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link to a screenshot in a help guide. The scanner mistook the link's access code for a secret API key, but it is just part of a public image URL.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed CDN image URL query parameter on an arca.live image link inside a static HTML guide. It is not an API key or credential; it is a time-limited access token for a public screenshot embedded in documentation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:302
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test tool that builds the project's own code and runs it locally to compare old and new versions. It only runs code from the repository itself, not anything from users or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate flags a vm.runInThisContext call inside a parity test harness. The executed code is produced by esbuild from the project's own TypeScript entry point (src/main.ts) and is run locally as part of a developer test that compares 2.0 backend behavior against the 1.x reference. No network-fetched or user-supplied input reaches the executed code; the bundle is built in-process from committed source. This is a standard pattern for a test harness that needs to load a browser-format IIFE in Node.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/parity/run.mjs:68
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a viewing key for a screenshot on a public image site, embedded in a help guide. It is not a secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key on a screenshot image URL in a static HTML guide. It is an img src query parameter with an expires timestamp, not a runtime credential. No code executes or transmits it beyond normal image loading.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:245
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link to a screenshot in a help guide. The scanner mistook the link's access code for a secret API key, but it is just part of a public image URL.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed CDN image URL query parameter on an arca.live image link inside a static HTML guide. It is not an API key or credential; it is a time-limited access token for a public screenshot embedded in documentation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:333
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link to a screenshot in a help guide. The scanner mistook the link's access code for a secret API key, but it is just part of a public image URL.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed CDN image URL query parameter on an arca.live image link inside a static HTML guide. It is not an API key or credential; it is a time-limited access token for a public screenshot embedded in documentation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:346
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test tool that loads the project's older source code from disk and runs it locally so the new version can be compared against it. It only uses files already in the repository, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate flags a vm.runInThisContext call that executes the legacy 1.x backend source (reference/native-backend.js) read from the local filesystem. The file path is constructed from the repository root and a fixed filename; no external or user-controlled input determines the executed content. The purpose is to load the old backend in a Node context so the parity harness can replay scenarios against both backends. This is consistent with the stated project purpose of verifying identical behavior between versions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/parity/run.mjs:50
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a time-limited viewing key for a screenshot on a public image board, used in a help guide. It is not a secret credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key on a screenshot image URL in a static HTML guide document. It is an img src query parameter paired with an expires timestamp, not a runtime API credential. No execution or exfiltration path exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:134
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link to a screenshot in a help guide. The scanner mistook the link's access code for a secret API key, but it is just part of a public image URL.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a signed CDN image URL query parameter on an arca.live image link inside a static HTML guide. It is not an API key or credential; it is a time-limited access token for a public screenshot embedded in documentation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:315
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for viewing a screenshot on a public image site, included in a help document. It is not a secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key on a screenshot image URL embedded in a static HTML guide. It is an img src query parameter with an expires timestamp, not a runtime credential. No code path uses it for authentication or exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:110
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a viewing key for a screenshot on a public image board, used in a help guide. It is not a secret credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key on a screenshot image URL in a static HTML guide. It is an img src query parameter with an expires timestamp, not a runtime API credential. No execution or data flow reaches it beyond image loading.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:194
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a time-limited viewing key for a screenshot on a public image site, embedded in a help guide. It is not a secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key on a screenshot image URL in a static HTML guide document. It is an img src query parameter paired with an expires timestamp, not a runtime credential. No code executes or transmits it beyond normal image loading.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:220
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that loads the project's own backend code so it can be exercised in a simulated environment. The code it runs comes from a file already inside the project, not from anything a user or attacker can control. Running your own code in a test harness is normal and not a security issue.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged line executes backend source code via vm.runInThisContext, but the code being executed is read directly from a local committed file (src/native-backend.js) within the project itself. No external, user-controlled, or network-derived input reaches the executed string. This is a test/smoke harness loading its own backend module into a Node VM context to exercise it, which is a normal pattern for a local test runner. The file is part of the project's reference/test tooling and does not introduce any dynamic execution of untrusted data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- reference/smoke.mjs:186
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a testing tool that compiles the project's own code and runs it to measure performance. It only runs code the project itself produced, not anything from users or the internet, and it is only used during development.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched vm.runInThisContext call lives in a benchmark tool that builds the project's own source via esbuild and executes the resulting bundle to measure gallery-listing performance. The executed text is the project's own compiled output, not user-supplied or remote input. This is a developer-only test harness invoked by the bench npm script, not shipped runtime code. No untrusted data reaches the VM execution path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- tools/bench-gallery.mjs:114
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a link key for viewing a screenshot on a public image board, included in a help document. It is not a secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key on a screenshot image URL in a static HTML guide. It is an img src query parameter with an expires timestamp, not a runtime API credential. No execution or exfiltration path exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:155
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is a viewing key for a screenshot on a public image site, used in a help guide. It is not a secret credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The matched value is a CDN signed-access key on a screenshot image URL in a static HTML guide document. It is an img src query parameter paired with an expires timestamp, not a runtime credential. No code path uses it for authentication or exfiltration.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- 아카라이브_인레이넥서스_가이드.html:167