No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material4 low
What this review found
No material or immediate-danger item was identified.
Minor cautions
zizmor reported unpinned-uses
Minor caution · high confidence
The CI workflow uses a version number to reference a standard GitHub tool instead of locking it to an exact snapshot. This is a common practice and a minor hardening gap, not a security hole.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Pin the action to a full commit SHA for reproducibility and supply-chain hardening.
The CI workflow uses a version number to reference a standard Node setup tool instead of locking it to an exact snapshot. This is a common practice and a minor hardening gap, not a security hole.
Technical evidence
Scanner reason: zizmor matched workflow-security rule unpinned-uses in this repository.
Contextual assessment: The workflow references the official first-party setup-node action by major version tag rather than a commit SHA pin. The job only installs Node and runs local test and lint steps with contents read permission. No secrets, deployments, or artifact uploads are involved. Using a mutable tag for an official action is a best-practice gap but does not create a material vulnerability in this context.
Impact: low · Exploitability: unlikely
Developer action: Pin the action to a full commit SHA for reproducibility and supply-chain hardening.
The workflow downloads the full project history, which could theoretically leave a temporary credential in the build environment. Because nothing is saved or uploaded from the build and the credential is read-only, the practical danger is very low.
Technical evidence
Scanner reason: zizmor matched workflow-security rule artipacked in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: low · Exploitability: unlikely
Developer action: Consider using a token with minimal scope or configuring checkout to avoid persisting credentials if full history is not required.
The test file loads the project's own source code into a controlled sandbox to run unit tests on the directive parser. No external or user-supplied content is executed, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.