Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flags a generic unsafe-regex signal across nine fixed locations. The actual supplied patterns are refusal-detection, error-classification, retry-timing, and URL-origin regexes. Their quantifiers are either bounded with explicit length limits or structurally constrained lazy matches, and they operate on short inputs: model answers, error strings, and configured host addresses. No catastrophic backtracking shape, no attacker-controlled long input path, and no exfiltration or execution behavior is present in the evidence. The regexes match the extension's stated purpose of judging rewrite answers and classifying provider errors before retrying.
A scanner flagged a script line that downloads and runs an installer. This is a setup script for people working on the project's code, not part of the extension users install. It installs a standard build tool, and only downloads the installer from the tool maker's own website when the normal package install could not be used. Downloading and running a vendor's official installer is a common, openly documented way to set up a development machine. The risk is only the ordinary one of trusting that vendor's website, the same trust as installing any software package.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.download-and-execute.shell-pipeline. The match applies to this repository.
Contextual assessment: The flagged line is a fallback in a developer environment-setup script: when the bun runtime is missing and a package-manager install fails, it pipes the official bun installer over HTTPS into a shell. This is a conventional, disclosed bootstrap pattern for development environments, reached only manually in a fresh sandbox, with the package-manager route tried first and the whole step clearly commented and announced. The destination is the vendor's own documented install endpoint, not an unusual or obfuscated source, and the script performs no hidden persistence, no credential access, and nothing in the shipped extension runtime. The pattern inherently trusts the vendor endpoint, the same trust any dependency install carries, but the supplied evidence shows no attacker-controlled trigger or concrete harm path.
Impact: low · Exploitability: unlikely
Developer action: Optionally pin or verify the installer against a published checksum before execution, so the setup step does not depend solely on the vendor endpoint remaining trustworthy.
The scanner saw a web address in the code and flagged it. It is a made-up address used only by the project's own automated tests: the test pretends that address exists so the extension's panel can be exercised in a pretend browser. Nothing is ever actually sent over the internet, and this code does not run when users install the extension.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link. The match applies to this repository.
Contextual assessment: The flagged URL is a synthetic origin used only inside the browser-based test harness. The test intercepts requests to that hostname via route interception and fulfills them with locally generated stub HTML, so no network request to any external destination ever occurs. The fake origin exists solely because browser storage APIs throw on a blank page, and the same hostname is used for navigation within the isolated headless test page. This is a test file, not shipped extension code, and there is no data flow to any real remote host.
A static scanner flagged the patterns that clean up a model's notes for display as possibly slow. The actual patterns are simple: one removes markup tags from text, and one pulls the working out from between a pair of tags. They run on a single model answer inside the extension's own panel, and even a worst case would only make that one card draw slowly. Nothing here sends data anywhere or touches anything outside the display.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The flagged regexes strip markup tags from the model's working notes and extract the body between a named notes tag. The tag-matching pattern uses a lazy attribute match and a character class that cannot overlap ambiguously with the following alternation, and the body-extraction pattern expands a lazy any-character match linearly against a closing tag or end of input. Both run once per refine on locally displayed model output in the extension's own panel. No unbounded nested quantifiers, no attacker-controlled long-input path beyond the model's own reply, and no network, credential, or persistence behavior is involved.
The scanner noticed the code reading settings from the computer's environment. In the test launcher, those settings only tell it where a copy of the Chromium browser is installed so the automated tests can run. The values stay on the person's own machine, nothing is sent anywhere, and none of this code runs in the extension users install.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.serialize-environment. The match applies to this repository.
Contextual assessment: The environment-variable reads flagged by the scanner occur in the browser-test launcher and read two well-known configuration variables that locate an installed Chromium binary for the automation harness. The read values are used only as a local executable path passed to the browser launcher, or to scan a local directory for a Chromium build, and are never serialized, transmitted, logged to a remote destination, or persisted. This is test-scope code that does not ship or execute in the installed extension, and the accessed variables contain browser locations rather than credentials.