TavernKeeper Advisory reports for Tavernary

TavernKeeper Scan Report

twitter/twemoji

Commit bad3bce Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 30 low

What this review found

No material or immediate-danger item was identified.

Deterministic technical evidence (30)

  • JavaScript analysis reported javascript.xray.unsafe-command · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

    Source: scripts/utils.js:34

  • Dependency advisory GHSA-2g4f-4pwh-qvx6:pkg:cad7e9fb17eb5405be0d1fe2 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-v6h2-p8h4-qcjw:pkg:954583494f7b71625ae8e6ee applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • JavaScript analysis reported javascript.xray.obfuscated-code · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: src/test/test.js:1

  • Dependency advisory GHSA-mh99-v99m-4gvg:pkg:30da7db405d2e49715cb0ed6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-f8q6-p94x-37v3:pkg:867add7bb9bab6e9895407db applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: src/test/test.js:1

  • Dependency advisory GHSA-6rw7-vpxm-498p:pkg:0c9bcbbe992a5f1cf2ecf8d6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-p8p7-x288-28g6:pkg:f498895dfeec349e91e305f9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-w5hq-g745-h8pq:pkg:49d6ddac6a71fb42a3f1a09d applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-hrpp-h998-j3pp:pkg:84deddaa1c5f27b2029349c3 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-fjxv-7rqg-78g4:pkg:6c89c9914b40635e432f1415 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-3ppc-4f35-3m26:pkg:2bf515c0923623db447da2b6 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-xvch-5gv4-984h:pkg:01fee4d7faf3fb21b68dbb29 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-7r86-cg39-jmmj:pkg:46587393f7992d1314231deb applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-72xf-g2v4-qvf3:pkg:49c2ec50c11df2c4278b7a4a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-w7jw-789q-3m8p:pkg:16ec289071eeaa1d35511ec9 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-896r-f27r-55mw:pkg:dc62eb0daa24584c8443df50 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-jmr9-qjv8-65gv:pkg:6552b663ea1c29f8d95f9752 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-3jxr-9vmj-r5cp:pkg:c6056f5a45897dd10bfacade applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • JavaScript analysis reported javascript.xray.shady-link · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-content · Execution scope: test-documentation-data

    Source: src/test/test.js:613

  • Dependency advisory GHSA-3xgq-45jj-v275:pkg:e830bbdbb0dcffffb66f6af5 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-f886-m6hf-6m8v:pkg:db05cad6d25aec0390d39a8c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-23c5-xmqv-rm74:pkg:0a7bf6a56749ce1808ad443c applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • JavaScript analysis reported javascript.xray.obfuscated-code · javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1

    This technical signal is not part of the shipped runtime behavior.

    Policy reason: javascript-xray-inert-tooling · Execution scope: tooling-only

    Source: scripts/build.js:1

  • Dependency advisory GHSA-rgw5-rvv9-x895:pkg:567c541f015fe4079ca9b17e applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-hmw2-7cc7-3qxx:pkg:b55f5aef11b0369cc46f988a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-vh95-rmgr-6w4m:pkg:c3cf42767ec5124123a5f25a applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-395f-4hp3-45gv:pkg:726b56d7f001ed2589ee915f applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

  • Dependency advisory GHSA-c2qf-rxjj-qqgw:pkg:ab65b7005a72c477b6792a72 applies · osv-scanner 2.4.0

    A dependency has a published security issue, though this scan does not show that the project exposes it to an attacker.

    Policy reason: osv-structured-advisory · Execution scope: unknown

    Source: yarn.lock

Coverage and limitations

Inventory
7406 files · 12393412 bytes
Contextual coverage
30 of 30 candidates assessed

JavaScript coverage

Status
Incomplete
Candidates
5 files · 83562 bytes
X-Ray review families
5 warning occurrences compacted to 5 evidence-preserving review families
Representations
5 raw · 70 decoded · 0 normalized · 0 bundle modules
Stage scans
5 raw signatures · 4 raw AST · 5 raw OpenGrep · 70 derived signatures · 2 derived AST · 70 derived OpenGrep

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity
Full commit
bad3bceeafc901ace42a3dfe0421db6388daafb9
Completed
History depth
20 commits
Method
Deterministic evidence with contextual review
Reviewer
Not used — deterministic policy
Scanner
0.1.0
Scanner policy
5
Rule catalog
2
Contextual policy
5
Ecosystem context
sillytavern-community-v1
Prompt
contextual-review-v7
Assessment schema
contextual-assessment-v2
Review provenance
0 fresh / 0 reused groups · 0 fresh / 0 reused candidates
Review source reports
none
Evidence triage
30 deterministic / 0 contextual candidates · 0 contextual / 9 total behavior cases
Model budget
0 model calls · 0 / 12 fresh cases · 0 / 200000 estimated input · 0 / 250000 actual input · 0 / 40000 output tokens
Review usage
0 input · 0 output · 0 cache read · 0 reasoning tokens
Report
8610809db5601bbf121569743b3b11becc4b94ad00ec196e452c281aa3f6d28f